NIS2 requires essential and important entities across 18 sectors to implement cybersecurity measures or face fines up to €10M. We deliver NIS2 gap assessments, policy implementation, and audit-ready compliance.

Entity classification, security posture mapping against all 10 Article 21 measures, and a prioritized compliance roadmap.
All-hazards risk management framework covering threat identification, risk treatment plans, and continuous monitoring.
Complete incident management capability with 24h/72h/1-month reporting workflows and tabletop exercises.
Critical supplier assessments, contractual security clauses, and ongoing vendor risk monitoring per Article 21(2)(d).
Board-level governance structures, management training, and accountability documentation for Article 20 compliance.
Compliance dashboards, internal audit schedules, evidence collection, and ongoing policy review cycles.
The NIS2 directive introduces strict sanctions for non-compliant entities across the EU:
Essential entities: up to €10M or 2% of annual turnover. Important entities: up to €7M or 1.4% of turnover. Management is personally liable.
NIS2 Article 20 holds management personally liable for cybersecurity oversight. Board members face temporary suspension from managerial functions for non-compliance.
Without documented incident response plans, average recovery exceeds 23 days after a significant cyber incident. Unstructured response leads to extended downtime and cascading failures.
NIS2-compliant customers must verify supplier security posture under Article 21(2)(d). Non-compliant suppliers risk exclusion from major EU enterprise and public sector contracts.
Article 21 defines 10 minimum cybersecurity measures that all essential and important entities must implement.
We classify your organization as essential or important under NIS2 and define the compliance boundary across business units and systems.
We audit your cybersecurity posture against all 10 Article 21 measures, scoring each for maturity and prioritizing gaps by risk level.
We implement policies, incident response plans, supply chain programs, access controls, and training — all documented for regulatory audit.
We prepare compliance evidence packages, conduct audit simulations, and provide quarterly reviews with continuous monitoring.

NIS2 applies to medium and large organizations (50+ employees or €10M+ turnover) in 18 sectors across Annexes I and II — energy, transport, banking, healthcare, digital infrastructure, manufacturing, and more. Certain entities like DNS providers and trust service providers must comply regardless of size.
Essential entities face fines up to €10M or 2% of global turnover. Important entities face up to €7M or 1.4% of turnover. NIS2 also introduces personal liability — board members can be suspended from managerial functions.
The EU transposition deadline was October 2024. Croatia's law entered into force in November 2024. There is no grace period — enforcement powers are active and essential entities face proactive audits now.
NIS2 requires multi-stage reporting: a 24-hour early warning to the national CSIRT, a 72-hour notification with severity assessment, and a final report within one month with root cause analysis. Missing any deadline is a compliance violation.
ISO 27001 covers about 70-80% of NIS2 requirements. Key NIS2 gaps include mandatory 24-hour incident reporting, specific supply chain security obligations, personal management liability, and registration with national authorities.
Article 20 requires management to approve and oversee cybersecurity measures. Board members must undergo cybersecurity training and face personal liability — including suspension — if the organization fails to comply.
Generally no — NIS2 targets organizations with 50+ employees or €10M+ turnover. However, DNS providers, trust service providers, and sole providers of essential services must comply regardless of size. Small suppliers may face indirect requirements through contracts.
We start immediately with entity classification and gap assessment. Most organizations achieve initial NIS2 compliance in 3 to 6 months depending on size and existing security maturity.
Free initial consultation to determine your NIS2 entity classification and identify compliance gaps. We start immediately.