Directly affected
This is the case if your company belongs to one of the covered sectors and reaches the thresholds for headcount and turnover. Whether that applies is a legal question for your in-house counsel or lawyer to answer, not for us.
Evidence that stands up to an audit
NIS2 is implemented in your technology,not in a binder.
Most companies first encounter NIS2 on paper: as a directive, a questionnaire or a letter from a customer. But NIS2 is implemented in the infrastructure, in permissions, logging, backup and emergency plans. We take care of this technical part, and we tell you up front how big it is.
Are we affected at all?
NIS2 can reach you in three ways. Many companies overlook the third.
Through the supply chain
Even companies that don't fall under the directive themselves feel it through their customers, because affected companies have to hold their suppliers to the same standards. For a supplier, that means the questionnaire arrives, and the answer decides the contract.
Through the insurer
Cyber insurers now ask about the same points. If you can't prove them, you pay more or get no cover.
The most common case in practice is that a company is not directly affected, but a major customer demands evidence. The technical effort is the same, but the time pressure is greater because a contract depends on it.
The seven areas
NIS2 requires risk management measures. Technically, this means the following:
Access control
Who may do what is assigned traceably and reviewed regularly. This is where most companies have the most catching up to do, and it is exactly our core topic.
Identity & Access ManagementMulti-factor authentication
MFA must apply across the board, with no exceptions for management or legacy applications. It is precisely these exceptions that stand out in an audit.
Backup and recovery
Saying “we back up daily” is not enough. What is required is a tested restore with a documented result, because nobody knows whether a backup that has never been restored actually works.
Logging and detection
Security-relevant events must be recorded and evaluated. Logs that nobody looks at don't serve this purpose.
Hardening and patch management
Known vulnerabilities must be closed promptly. Systems should also stay in a defined state so that deviations are noticed.
Incident handling
An emergency needs a process that defines who decides, who reports, who communicates and within what deadline. This process should be rehearsed, not just exist as a file.
Demonstrability
This point connects all the others, because being secure is not enough. You also have to be able to prove it. That is why we document during implementation, not afterwards.
How we work
- 01
Gap analysis
We compare the current state with the technical requirements. You receive a written report that ranks the gaps by risk and effort.
- 02
Action plan
We define what comes first, what can wait and what it costs. The effort estimate is realistic, not a wish list.
- 03
Implementation
We implement in stages during normal operations and document every step along the way.
- 04
Evidence package
You receive documentation that you can present to a customer or auditor and that belongs to you.
What we don't do: the legal assessment of whether you are affected, reports to authorities and certifications. That is what lawyers and auditors are for. We work with them instead of pretending you don't need them.
Pricing
| Security Assessment incl. NIS2 gap analysis | from €6,900 |
| IT Security Check (smaller scope) | €2,490 |
| Implementation and project management | €165 / h |
| Identity & Access Management (IAM) | €140 / h |
The cost of the assessment is credited towards a follow-up project.
Pricing by building block
The effort depends on what the gap analysis finds:
| Access control and role model | from €15,000 |
| MFA across the board | €4,000 to €8,000 |
| Backup with restore test | €3,000 to €6,000 |
| Logging | €6,000 to €12,000 |
| Hardening and patch process | €5,000 to €10,000 |
| Incident process incl. exercise | €4,000 to €7,000 |
| Evidence package | €3,000 to €5,000 |
Typical overall projects range from €20,000 to €60,000.
Gap analysis and concept work are consulting services and therefore eligible for funding in several German federal states, typically with 50 percent of the fee.
The order is what matters: first the quote, then the application, then wait for the approval notice and only then commission the work. Anyone who starts earlier loses the entitlement. We help you with the paperwork.
More on funded IT consultingExperience
Banking sector · 250 users
Design and rollout of a new ITSM solution. We advised the bank in close dialogue and supported it from implementation through go-live and into post-launch support.
Result: The planned twelve months between project start and go-live were met. This was followed by a hypercare phase in which we supported operations closely.
Pharma research, international · 5 users
Complete takeover of the IT of an internationally active research company and realignment in close coordination with management.
Result: A fully automated IT environment designed for security and NIS2 requirements: separate admin and user accounts and secured international VPN routing between the locations.
Updated:
FAQ
Frequently asked questions
Are we affected by NIS2?
That is a legal question that we don't answer bindingly. Your legal adviser is responsible for that. In practice, though, the question is settled as soon as a customer sends you a security questionnaire.
We are too small for NIS2.
That may be. The topic will still reach you through the supply chain, because affected companies pass the requirements on to their suppliers.
Is a certification enough?
Not on its own. A certification proves a management system, while NIS2 also requires that the technical measures actually work. The overlap is large, but a certificate and implementation are not the same thing.
We already have a firewall and antivirus.
That gives you basic protection, but not risk management. NIS2 asks about access control, traceability, tested recovery and an incident process.
How long does it take?
The gap analysis takes two to three weeks, and implementation several months depending on the size of the gaps. If you need to be ready by the date of a customer audit, plan for six months.
Do you also handle the reports to the authority?
No, the reporting obligations lie with the company. We make sure you have the technical information that a report requires.
Cybersecurity & NIS2
Where do you stand?
Many providers use NIS2 as a way to apply pressure. We look at your situation and tell you what is actually necessary, even if that is less than you feared.