NIS2 consulting and readiness

What NIS2 asks of a company

Directive (EU) 2022/2555, known as NIS2, replaced the first NIS Directive. Member States had until 17 October 2024 to transpose it into national law, and its measures apply from 18 October 2024. For an essential or important entity the obligations fall into four families, and a well-run readiness programme covers all of them:

• Registration with the national authority, which collects at least the entity's name, address, contact details, sector and the Member States where it provides services (Article 3(4)). Certain digital providers, such as DNS and cloud providers, data centres, managed service providers and managed security service providers, also register under Article 27, in the Member State of their main establishment (Article 26(1)(b)).
• Cybersecurity risk-management measures, technical, operational and organisational (Article 21), based on an all-hazards approach and broken down into ten elements: from risk analysis to business continuity, from supply chain security to multi-factor authentication.
• Reporting of significant incidents to the CSIRT or competent authority (Article 23): an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours, a final report within one month of the notification.
• Obligations of the management bodies (Article 20): they approve the risk-management measures, oversee their implementation, follow training, and can be held liable for infringements.

Fines are set by each Member State within the limits of Article 34: maximum administrative fines of at least €10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and at least €7 million or 1.4% for important entities. For essential entities, if enforcement measures prove ineffective and the entity does not act within the time set, authorities can ask the relevant bodies, courts or tribunals to temporarily prohibit any person discharging managerial responsibilities at CEO or legal representative level from exercising managerial functions (Article 32(5)).

The point that changes the consulting work is another one. The directive says what to do; the how and how much are set by each country's transposing law and, for some providers, by EU implementing acts. Commission Implementing Regulation (EU) 2024/2690 lays down the technical and methodological requirements of the Article 21 measures for DNS service providers, TLD name registries, cloud computing and data centre service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers, and specifies when an incident is significant for them. A NIS2 readiness programme is measured against those texts, requirement by requirement.

The ten measures of Article 21, in plain terms

Article 21(2) is the backbone of every NIS2 programme. The measures need to be appropriate and proportionate to the risk, and they cover:

1. policies on risk analysis and information system security;
2. incident handling;
3. business continuity, such as backup management and disaster recovery, and crisis management;
4. supply chain security, including the relationship with each direct supplier or service provider;
5. security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure;
6. policies and procedures to assess the effectiveness of the measures;
7. basic cyber hygiene practices and cybersecurity training;
8. policies and procedures on cryptography and, where appropriate, encryption;
9. human resources security, access control policies and asset management;
10. multi-factor or continuous authentication, and secured voice, video, text and emergency communications where appropriate.

None of these is a document to download. Each one turns into decisions, owners, configurations and evidence that the measure is running.

If you haven't finished yet

It happens, and there is no point pretending otherwise. The directive asks an entity that finds it is not compliant to take, without undue delay, all the necessary, appropriate and proportionate corrective measures (Article 21(4)). Supervision differs by category: essential entities are subject to proactive supervision, including inspections, regular and targeted audits and requests for evidence (Article 32); important entities to supervision after the fact, when there are indications of non-compliance (Article 33).

The sensible move, then, is to be ready with three things: an honest measurement requirement by requirement, a plan with dates and owners approved by the management body, and the first actions already started on the gaps that weigh most. No one can guarantee the outcome of a supervisory check. But you can be in a position to show, at any moment, where you are and where you are heading.

First of all: does NIS2 apply to you, and how?

The applicability check is the first piece of work, and getting it wrong is costly: you work on the wrong set of requirements, or you find out late that you are in scope. The directive combines three criteria (Articles 2 and 3):

• Sector: the entity types in Annex I (sectors of high criticality, such as energy, transport, banking, health, digital infrastructure and B2B ICT service management) and Annex II (other critical sectors, such as postal services, waste management, chemicals, food, manufacturing, digital providers and research).
• Size: for these sectors the directive applies to medium-sized and large enterprises as defined in Recommendation 2003/361/EC, as a rule taking partner and linked enterprises into account. In practice: 50 or more employees, or annual turnover and balance sheet both above €10 million.
• Regardless of size: among others, providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers, and entities that a Member State identifies because they are the sole provider of an essential service or because their disruption would have a significant impact.

Then there is the category, which decides how much supervision you face: essential or important (Article 3). Large entities in the Annex I sectors are, as a rule, essential; most others in scope are important. If you are already registered or notified, your national authority has the category; if not, it follows from sector, entity type and size. If you operate in the financial sector, the relationship with DORA comes first: where a sector-specific EU act requires equivalent measures, that act applies (Article 4), and for financial entities that act is DORA. See our DORA page.

And if you are out of scope? NIS2 often reaches you anyway, through your customers. An entity in scope takes into account the vulnerabilities and security practices of each direct supplier (Article 21(3)), sets security requirements and puts them into contracts. For a supplier to an in-scope company, that means questionnaires, clauses and audits even without being a NIS2 entity.

The NIS2 readiness path, phase by phase

This is the path we follow with mid-market companies. There are seven phases; the timeline depends on the starting point and we set it after the first measurement, not before.

1. Scope and category

Which group companies are in, in which category, for which services, and therefore on which network and information systems. Defining the systems that support the services for which you are in scope is the choice that weighs most on everything else. Outcome: a written scope, the list of relevant systems, the texts that apply to you (directive, national law and, where relevant, the Implementing Regulation).

2. Gap analysis on the requirements

For each requirement that applies to you: what is in place, what is missing, which evidence proves it, how much the gap weighs. Not an average maturity score, which doesn't tell you which requirements are missing.

3. Risk assessment and remediation plan

The measures start from a risk assessment based on an all-hazards approach, and the management body approves the measures that follow (Article 20). We build the remediation plan with priorities by risk and urgency, owners and dates. For business continuity, a business impact analysis is usually needed.

4. Documentation

The ten elements of Article 21 translate into policies, plans, inventories and records: risk analysis and information security policy, incident response plan, business continuity and disaster recovery plans, supplier inventory and assessments, vulnerability management, training plan and records, access and asset management. We write documents around your processes, in an editable format, and where an ISO/IEC 27001 system already exists we reuse what holds up. To collect and keep the evidence up to date we work with Vanta.

5. Technical measures

This is the part that doesn't close with a document: multi-factor authentication, backups that are created, maintained and tested, endpoint security, technical tools to detect incidents promptly, vulnerability management. In the cloud the same measures translate provider by provider; for cloud posture we work with Wiz, of which we are a partner.

6. Incident handling and reporting

You need an incident handling process and a reporting plan, approved and reviewed after every significant incident. But the plan only holds if someone notices the incident in time for the 24-hour early warning: this is where our 24/7 SOC comes in, detecting, handling and supporting reporting within the required timeframes.

7. Training and governance

Members of the management bodies are required to follow cybersecurity training, and entities are encouraged to offer similar training to their employees regularly (Article 20(2)). We prepare the board session and a reporting format the board can actually read: a one-page summary with risks, status of the measures and open gaps, with the technical annexes behind it.

What we need from you

A readiness programme can't be fully delegated, and anyone who promises otherwise is selling you a document. What we ask of the company:

• A sponsor in the management body. Risk assessment, plans and policies go through there: without someone following the project from the board, approvals become the bottleneck.
• An internal point of contact with dedicated time, usually the IT manager or head of security, often already the contact point for the national authority.
• Access to what already exists: inventories, network diagrams, contracts with IT suppliers, ISO documents, results of vulnerability assessments and penetration tests.
• The people who know the processes: whoever manages suppliers, whoever is responsible for continuity, whoever decides on purchases. These are the areas where gaps emerge most often.
• Decisions on risk. We measure, propose and build; which residual risk to accept is decided by the management body.

NIS2 certification: what can actually be demonstrated

There is no NIS2 certification for a company. The directive does not provide for a certificate declaring an organisation compliant. Article 24(1) allows Member States to require the use of particular ICT products, services and processes certified under European cybersecurity certification schemes, and Article 24(2) empowers the Commission to make this mandatory for certain categories of entities through delegated acts. Either way, these are European cybersecurity certification schemes under Regulation (EU) 2019/881, not a certificate that the organisation complies with NIS2.

Compliance is supervised by the national competent authority, with the tools of Articles 32 and 33: on-site inspections and off-site supervision, regular and targeted security audits by independent bodies, requests for information and evidence. For important entities these measures are triggered when there are indications of possible infringements.

What can be demonstrated is something else: requirement by requirement, that the measure is in place and where the evidence is. That is what a well-run programme should leave you with. ISO/IEC 27001 helps and is a genuine certification, but it does not replace registration, incident reporting and the obligations of the management body, and it does not follow the structure of Article 21 one to one. The path is on our ISO 27001 page.

The mistakes we see most often

• Working from summaries instead of the texts that apply to you. The ten elements of Article 21 are the headline; the requirements sit in your national law and, for digital providers, in Implementing Regulation (EU) 2024/2690.
• Getting the scope of relevant systems wrong. Too broad and the project never ends, too narrow and it doesn't stand up to a check.
• Documents ready before the analysis. Documents need to reflect the current situation and be updated when it changes: a generic template doesn't.
• Forgetting the board. The measures are approved by the management body: without a board resolution, the evidence is missing.
• Treating reporting as a form. Without continuous detection, the 24-hour early warning stays on paper.
• Forgetting the contracts. Supply chain security means security requirements in new and renewed contracts with relevant suppliers: you need a process, not a copied clause.

How to choose who supports you

NIS2 consulting is judged by its method, not by its presentation. Four questions to ask anyone, us included:

1. Can you show me an example of a gap analysis? It should reference the articles and national provisions that apply, requirement by requirement.
2. Who covers the legal side and who the technical side? You need both.
3. What do I keep after delivery? Editable documents, written around my processes, that my team can maintain.
4. Who detects incidents at night and at weekends? If the answer is nobody, the 24-hour early warning doesn't hold.

Be wary of anyone who promises a NIS2 certificate or guarantees the outcome of an inspection.

What the effort of a readiness programme depends on

We don't publish price lists: two companies with the same turnover can have very different projects. The variables that count are these:

• Category: essential or important, and whether the Implementing Regulation for digital providers applies to you.
• Companies, sites and relevant systems within the scope.
• Starting point: a mature ISO/IEC 27001 system, up-to-date inventories and a tested continuity plan reduce the work considerably.
• Number and criticality of suppliers with access to your systems.
• Operational coverage: whether incident detection already exists or needs building.
• Time available: with only a few months ahead, the work focuses on the gaps that weigh most, with more presence in the first weeks.

After the applicability check and a first measurement we give you a tailored estimate, separating project work from ongoing services.