The EU cybersecurity directive for essential and important entities.
NIS2 compliance consulting that gets you compliance-ready and leaves you more secure.
We bring your organisation into NIS2 compliance by combining our specialist advisory practice with your unique operational context and business goals.
You work with security practitioners who understand what NIS2 requires as well as the governance and technical controls needed to meet it in practice.
We map existing controls and frameworks like ISO 27001 against NIS2, so you only invest time and resources where real work is needed.
We do not sell a GRC platform or other technology. Our advice is driven by what NIS2 requires and what is right for your environment, not by what generates recurring licence revenue for us.
Our NIS2 compliance programmes are built to deliver security, return on investment, and long-lasting benefits.
NIS2 applies primarily to medium and large organisations operating in sectors classified as Essential or Important under the Directive.
Essential sectors include energy, transport, banking, financial market infrastructure, healthcare, drinking and waste water, digital infrastructure, ICT service management, public administration and space.
Important sectors include postal and courier services, waste management, chemicals, food production and distribution, manufacturing, digital providers and research organisations.
The NIS2 requirements that apply to you depend on where and how you operate. Even if you’re based outside the EU, you may still encounter NIS2 requirements through your EU operations, customers, or supply chain.
NIS2 requires organisations to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks.
The Directive requires organisations to implement risk management measures across ten core domains, including:
It also introduces enhanced governance requirements and personal liability for senior management in the event of serious non-compliance.
There is no certification with NIS2. Compliance is assessed by national competent authorities, and non-compliance carries fines of up to €10 million or 2% of global turnover for essential entities.
NIS2 also introduces strict reporting requirements for significant incidents, beginning with an early warning within 24 hours of becoming aware of the incident, followed by an incident notification within 72 hours and, generally, a final report within one month.
NIS2 scope and applicability assessments.
Gap analysis and remediation planning.
Governance and accountability framework development.
Supply chain security programme design.
Incident response and reporting readiness.
Control mapping against existing ISO 27001 programmes.
Regulatory engagement support.
We determine which NIS2 requirements apply to your organisation, compare what you have versus what’s required, and identify the gaps to be addressed.
Next, we create a practical, prioritised remediation plan to close the identified gaps.
Then, we work with your team to put the changes in place.
Finally, we check your controls and evidence against NIS2 and close any remaining gaps so that you can demonstrate compliance confidently.
| Framework | Type | Certificate | Jurisdiction | Overlap |
|---|---|---|---|---|
| NIS2 | Legal obligation | EU member states | DORA, CS&R Bill | |
| ISO 27001 | Voluntary certification | Universal | SOC 2, GDPR, NIS2, DORA |
|
| DORA | Legal obligation | EU financial entities | NIS2, ISO 27001 | |
| CS&R Bill | Legal obligation | UK | NIS2 |
Should your organisation need to comply with more than one regulatory testing framework at the same time, alongside NIS2, we also offer services under ISO 27001, DORA and Cyber Security and Resilience Act.
Thank you!
Please try again later.
