NIS2 Directive
The EU directive that extends mandatory cybersecurity to thousands of companies and holds management accountable. We tell you whether it applies and get you ready.
Directive (EU) 2022/2555
- What is at stake
- Up to €10M or 2% of global turnover
Who it applies to
- Essential and important entities across 18 sectors
- Medium and large firms in critical sectors
- Key suppliers to those entities
Typical timeline
3 to 6 months
Directive (EU) 2022/2555
In detail
The directive that extends mandatory cybersecurity to thousands of companies.
Directive (EU) 2022/2555, known as NIS2, replaces the original NIS and greatly expands the number of obliged organisations. It covers medium and large companies in 18 sectors, from energy, transport and health to manufacturing, food, waste management, digital services and managed IT providers.
It distinguishes essential from important entities. Both must apply risk management measures (Article 21), report significant incidents within very short deadlines and secure their supply chain. Essential entities face proactive supervision; important ones, reactive.
The big change is management accountability: management bodies must approve the measures, oversee them and be trained, and can be held personally liable for failures.
Real scenarios
What our clients ask most.
Does it apply to me?
We analyse your sector, size and activity to determine whether you are essential, important or out of scope, and document it.
My customers demand it
Even if you are not directly obliged, an in-scope customer will contractually require security measures through the supply chain.
Leadership doesn’t know what to sign
We train the board to understand risks, measures and their liability, as the directive requires.
What you get
What you will have at the end.
- Applicability analysis and classification
- Assessment against the 10 Article 21 measures
- Incident reporting procedure
- Supplier risk management
- Certified training for management
- Continuity and crisis management plan
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
NIS2
What we focus on
- 01
Risk management and technical measures
- 02
Reporting at 24 h, 72 h and 1 month
- 03
Supply chain security
- 04
Management training and liability
NIS2 Directive
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for NIS2 Directive cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Is a small company affected?
Generally not: the threshold is 50 employees or €10M turnover. There are exceptions, such as DNS providers, trust services or entities that are unique in their country.
What exactly must be reported?
Significant incidents: an early warning within 24 hours, a notification with initial assessment within 72 hours and a final report within one month.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.