Is my company affected by NIS2?

That depends on two questions. First, do you work in a sector listed in Annexes I and II of the directive? Examples are energy, transport, health, digital infrastructure, making certain products, waste management and food. Second, are you at least a medium-sized firm? As a rule, that means 50 or more staff, or yearly turnover and balance sheet above EUR 10 million. For some entities NIS2 applies no matter their size. Our scoping assessment gives you a clear answer for what you actually do.

What does NIS2 require?

Article 21 asks for suitable technical, operational and organisational steps to manage risk. These include risk analysis and security policies, how you handle incidents, and plans to keep the business running in a crisis. Security in the supply chain, fixing weak spots, encryption, access control and training are also on the list. So is sign-in with a second factor (MFA). On top come duties to report significant incidents and to register with the competent authority.

Which reporting deadlines apply to a security incident?

The directive sets three stages. An early warning is due within 24 hours of learning about a significant incident. A notice with a first assessment follows within 72 hours. A final report is due within one month. For this to work in an emergency, set roles, templates and decision paths in advance.

Is senior management personally liable?

NIS2 clearly holds management responsible. Under Section 38 of the German BSI Act (BSIG), management must implement the risk measures and oversee them. It must also take part in training on a regular basis. If management culpably breaches these duties and the company suffers a loss, it is liable under the company law that applies to its legal form. We prepare management so it can prove it meets this role.

Is an ISO 27001 certification enough for NIS2?

An ISMS to ISO 27001 covers a large part of Article 21. It is a very good base, but it does not cover everything. We check the duties for reporting, registration and management on their own. The same goes for single measures such as MFA or security in the supply chain. A mapping shows you what is already covered and where gaps are.

What does NIS2 consulting cost?

That depends on size, sector and where you stand today. We start with a free first call. Then you get an offer with clearly defined packages. Terms on request.

IT Security Management Systems

NIS2 · Article 21 · Reporting duties

NIS2 consulting: from scoping to implementation.

We find out if NIS2 applies to your company, and how. We show you the gaps against Article 21. Then we put the measures in place with you. That includes the reporting process and training for management.

Get a scoping assessment See our approach

24 h

Early warning for significant incidents

72 h

Notice with a first assessment

Art. 21

Steps to manage risk

Art. 20

Duties of management

What NIS2 means for your company

The EU's NIS2 directive puts far more companies under binding cybersecurity rules. It no longer covers just the classic operators of critical infrastructure. Many mid-sized companies are now in scope too. Sectors include energy, transport, health, digital services, manufacturing, waste management and food.

Companies in scope have three main duties. They must take suitable steps to manage risk. They must report significant incidents within tight deadlines. And they must register with the authority in charge. The law puts this duty clearly on management. Many other companies feel NIS2 as well. Their customers are in scope and pass the rules down the supply chain.

In Germany, NIS2 has applied since 6 December 2025 through the NIS2 Implementation Act and the revised BSI Act (BSIG). Our NIS2 overviewexplains who is affected, which deadlines apply and how high fines can be.

Our NIS2 consulting at a glance

Six building blocks. You decide which ones you handle yourself.

Scoping assessment

We check your sector, work and size against the rules of the directive and the German act that puts it in place. You get a written result: are you in scope, and as which type of entity?

Gap analysis against Article 21

We hold your current measures up against each point of Article 21. You get a list of gaps, sorted by urgency. Not a catalogue that treats everything as equally important.

Risk management and ISMS

We build or extend an information security management system (ISMS) as the frame for the NIS2 measures. If you wish, it can be certified to ISO 27001.

Reporting and incident process

Who is in charge, how issues move up and which templates to use for the 24-hour, 72-hour and one-month deadlines. Tested before it counts and aligned with your emergency plans.

Supply chain and service providers

We find your critical suppliers, write security rules into contracts and check them on a regular basis. In a planned way, not by just sending round a questionnaire.

Management training

Management must approve and oversee the measures and be trained on a regular basis. We run the training and give you the proof that it took place.

How we implement NIS2 with you

Six steps that build on each other. How long it takes depends on your size and how far along you are. We give you an estimate after the gap analysis.

Determine scope

Are you in scope? If so, are you an essential or an important entity? Oversight and the rules on sanctions depend on it.

Gap analysis

We compare where you stand with Article 21 and the duties for reporting and management. You get a sorted list of gaps with a rough guess of the work.

Registration and governance

Prepare the sign-up with the competent authority, assign roles and have management adopt the policy.

Implement measures

Close the gaps in order of priority, both in how you are organised and in your tech. With your team, your providers or with us.

Rehearse reporting

Walk through a realistic incident scenario: who decides, who reports, what goes into the early warning?

Evidence and continue

Records, internal audit and management review. So you can show authorities, customers and insurers what you do.

What you get

Written result of the scoping assessment
Gap analysis with a ranked plan of action against Article 21
Mapping between NIS2 rules and the measures you have (e.g. ISO 27001)
Process for reporting and escalation, with templates for all deadlines
Proof of training for management
Records that hold up with supervisors and customers

An ISMS as the foundation

An ISMS to ISO 27001 covers a large part of Article 21. It keeps NIS2 in hand over time. So it does not stay a one-off project.

ISO 27001 consulting

When an incident occurs

The clock for reporting starts once you know about the incident. Our incident response team helps you contain it. It secures the traces (forensics) and helps you prepare the reports.

Incident Response

Frequently asked questions about NIS2

Is my company affected by NIS2?: That depends on two questions. First, do you work in a sector listed in Annexes I and II of the directive? Examples are energy, transport, health, digital infrastructure, making certain products, waste management and food. Second, are you at least a medium-sized firm? As a rule, that means 50 or more staff, or yearly turnover and balance sheet above EUR 10 million. For some entities NIS2 applies no matter their size. Our scoping assessment gives you a clear answer for what you actually do.
What does NIS2 require?: Article 21 asks for suitable technical, operational and organisational steps to manage risk. These include risk analysis and security policies, how you handle incidents, and plans to keep the business running in a crisis. Security in the supply chain, fixing weak spots, encryption, access control and training are also on the list. So is sign-in with a second factor (MFA). On top come duties to report significant incidents and to register with the competent authority.
Which reporting deadlines apply to a security incident?: The directive sets three stages. An early warning is due within 24 hours of learning about a significant incident. A notice with a first assessment follows within 72 hours. A final report is due within one month. For this to work in an emergency, set roles, templates and decision paths in advance.
Is senior management personally liable?: NIS2 clearly holds management responsible. Under Section 38 of the German BSI Act (BSIG), management must implement the risk measures and oversee them. It must also take part in training on a regular basis. If management culpably breaches these duties and the company suffers a loss, it is liable under the company law that applies to its legal form. We prepare management so it can prove it meets this role.
Is an ISO 27001 certification enough for NIS2?: An ISMS to ISO 27001 covers a large part of Article 21. It is a very good base, but it does not cover everything. We check the duties for reporting, registration and management on their own. The same goes for single measures such as MFA or security in the supply chain. A mapping shows you what is already covered and where gaps are.
What does NIS2 consulting cost?: That depends on size, sector and where you stand today. We start with a free first call. Then you get an offer with clearly defined packages. Terms on request.

Find out whether NIS2 applies to you.

In a free first meeting, we check if you are in scope. Then we lay out the next steps.

Get a scoping assessment

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.