Is my company affected by NIS2?

That depends on two questions. First, do you operate in a sector listed in Annexes I and II of the directive? Examples are energy, transport, health, digital infrastructure, manufacturing of certain products, waste management and food. Second, do you reach the size of a medium-sized enterprise? As a rule, that means 50 or more employees, or annual turnover and balance sheet above EUR 10 million. For some entities NIS2 applies regardless of size. Our scoping assessment settles this definitively for your specific activities.

What does NIS2 require?

Article 21 requires appropriate technical, operational and organisational risk-management measures. These include risk analysis and security policies, incident handling, business continuity and crisis management. Supply-chain security, vulnerability management, cryptography, access control, training and multi-factor authentication are also on the list. On top of that come reporting duties for significant incidents and registration with the competent authority.

Which reporting deadlines apply to a security incident?

The directive sets out a staged procedure. An early warning is due within 24 hours of becoming aware of a significant incident. An incident notification with an initial assessment follows within 72 hours, and a final report within one month. For this to work in an emergency, responsibilities, templates and decision paths must be in place beforehand.

Is senior management personally accountable?

NIS2 explicitly holds management bodies responsible. They must approve the risk-management measures, oversee their implementation and take part in training regularly. For breaches, the directive provides for sanctions against the entity and holds management accountable. We prepare management so that it can prove it fulfils this role.

Is an ISO 27001 certification enough for NIS2?

An ISMS to ISO 27001 covers a large part of the Article 21 requirements. It is a very good foundation, but it does not cover everything automatically. Reporting processes, registration, management duties and single measures such as MFA or supply-chain security are checked separately. A mapping shows you what is already covered and where something is missing.

What does NIS2 consulting cost?

That depends on size, sector and your current maturity. After a free first consultation you receive an offer with clearly defined service packages. Terms on request.

IT Security Management Systeme

NIS2 · Article 21 · Reporting duties

NIS2 consulting: from scoping to implementation.

We find out if NIS2 applies to your company, and how. We show you the gaps against Article 21. Then we put the measures in place with you. That includes the reporting process and training for management.

Get a scoping assessment See our approach

24 h

Early warning for significant incidents

72 h

Notification with initial assessment

Art. 21

Risk-management measures

Art. 20

Duties of management bodies

What NIS2 means for your company

The EU's NIS2 directive brings far more companies under binding cybersecurity rules. It no longer covers just the classic operators of critical infrastructure. Many mid-sized companies are now in scope too. Sectors include energy, transport, health, digital services, manufacturing, waste management and food.

Companies in scope have three main duties. They must take suitable steps to manage risk. They must report significant incidents within tight deadlines. And they must register with the authority in charge. The law puts this duty clearly on management. Many other companies feel NIS2 as well. Their customers are in scope and pass the rules down the supply chain.

Our NIS2 consulting at a glance

Six building blocks. You decide which ones you handle yourself.

Scoping assessment

We check your sector, activity and size against the criteria of the directive and the German implementation act. You get a written result: are you in scope, and as which type of entity?

Gap analysis against Article 21

We compare your existing measures with every Article 21 requirement. You receive a prioritised gap list, not a catalogue that treats everything as equally important.

Risk management and ISMS

We build or extend an information security management system as the framework for the NIS2 measures. If you wish, it can be certified to ISO 27001.

Reporting and incident process

Responsibilities, escalation paths and reporting templates for the 24-hour, 72-hour and one-month deadlines. Rehearsed before it counts and aligned with your incident response.

Supply chain and service providers

We identify critical suppliers, anchor security requirements in contracts and review them regularly. In a structured way, not by sending round a questionnaire.

Management training

Management must approve and oversee the measures and be trained regularly. We deliver the training and the evidence for it.

How we implement NIS2 with you

Six steps that build on each other. How long it takes depends on your size and maturity. We give you an estimate after the gap analysis.

Determine scope

Are you in scope, and if so as an essential or important entity? Supervision and the sanctions framework depend on it.

Gap analysis

Current state against Article 21, reporting duties and management duties. Result: a prioritised gap list with a rough effort estimate.

Registration and governance

Prepare registration with the competent authority, assign roles and have management adopt the policy.

Implement measures

Close the prioritised gaps, both organisational and technical. With your team, your providers or with us.

Rehearse reporting

Walk through a realistic incident scenario: who decides, who reports, what goes into the early warning?

Evidence and continue

Documentation, internal audit and management review. So you can show authorities, customers and insurers what you do.

What you get

Written result of the scoping assessment
Gap analysis with a prioritised action plan against Article 21
Mapping between NIS2 requirements and existing measures (e.g. ISO 27001)
Reporting and escalation process with templates for all deadlines
Training records for management
Documentation that holds up with supervisors and customers

An ISMS as the foundation

An ISMS to ISO 27001 covers a large part of Article 21. It also keeps NIS2 easy to handle over time, so it does not stay a one-off project.

ISO 27001 consulting

When an incident occurs

The clock for reporting starts once you know about the incident. Our incident response team helps you contain it, runs the forensics and helps you prepare the reports.

Incident Response

Frequently asked questions about NIS2

Is my company affected by NIS2?: That depends on two questions. First, do you operate in a sector listed in Annexes I and II of the directive? Examples are energy, transport, health, digital infrastructure, manufacturing of certain products, waste management and food. Second, do you reach the size of a medium-sized enterprise? As a rule, that means 50 or more employees, or annual turnover and balance sheet above EUR 10 million. For some entities NIS2 applies regardless of size. Our scoping assessment settles this definitively for your specific activities.
What does NIS2 require?: Article 21 requires appropriate technical, operational and organisational risk-management measures. These include risk analysis and security policies, incident handling, business continuity and crisis management. Supply-chain security, vulnerability management, cryptography, access control, training and multi-factor authentication are also on the list. On top of that come reporting duties for significant incidents and registration with the competent authority.
Which reporting deadlines apply to a security incident?: The directive sets out a staged procedure. An early warning is due within 24 hours of becoming aware of a significant incident. An incident notification with an initial assessment follows within 72 hours, and a final report within one month. For this to work in an emergency, responsibilities, templates and decision paths must be in place beforehand.
Is senior management personally accountable?: NIS2 explicitly holds management bodies responsible. They must approve the risk-management measures, oversee their implementation and take part in training regularly. For breaches, the directive provides for sanctions against the entity and holds management accountable. We prepare management so that it can prove it fulfils this role.
Is an ISO 27001 certification enough for NIS2?: An ISMS to ISO 27001 covers a large part of the Article 21 requirements. It is a very good foundation, but it does not cover everything automatically. Reporting processes, registration, management duties and single measures such as MFA or supply-chain security are checked separately. A mapping shows you what is already covered and where something is missing.
What does NIS2 consulting cost?: That depends on size, sector and your current maturity. After a free first consultation you receive an offer with clearly defined service packages. Terms on request.

Find out whether NIS2 applies to you.

In a free first meeting, we check if you are in scope. Then we lay out the next steps.

Get a scoping assessment

How we work with you

We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.

1. Free initial conversation

We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.

2. Structured assessment

We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.

3. Delivery with a dedicated lead

An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.

4. Continuous operations & review

After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.