The EU is drastically tightening cybersecurity requirements - and for the first time is holding management personally liable. We assess whether you are in scope, close the gaps, and implement the technical measures.
NIS2 distinguishes between “essential” and “important” entities - and also covers many suppliers through the supply chain that previously believed they were unaffected.
Generally companies with at least 250 employees or €50 million in revenue in highly critical sectors: energy (electricity, photovoltaics, hydropower, district heating), transport, banking, financial markets, healthcare, drinking water, wastewater, digital infrastructure and public administration. Stricter supervision and proactive inspections.
Medium-sized companies with at least 50 employees or €10 million in revenue in other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, research, and digital service providers. Supervision is reactive - but the obligations still apply in full.
Article 21 of NIS2 requires appropriate state-of-the-art risk management. We translate the requirements into concrete, audit-ready measures.
NIS2 requires management to approve the risk management measures, oversee their implementation, and receive regular training. For essential entities, breaches may be punished with fines of up to €10 million or 2% of worldwide annual turnover.
Unlike under previous regulatory frameworks, responsibility cannot be fully delegated. We prepare your leadership specifically for this role.
Five questions about your NIS2 maturity. You receive an immediate initial assessment - with no email required.
We determine with legal certainty whether NIS2 applies to you and what type of entity you are, and assess the gap between your current state and the obligations under Art. 21.
You receive a prioritized plan covering effort, responsibilities, and deadlines - ordered by risk and impact, not alphabetically.
Our IT team implements encryption, MFA, access concepts, logging, backups, and infrastructure hardening - so you do not need a second service provider.
We establish the 24/72-hour reporting process, train your team and management, and rehearse an actual incident in a tabletop exercise.
We produce audit-ready documentation, keep you up to date when authorities make inquiries, and provide ongoing support for your security posture.
From NIS-2 to ISO 27001: we combine regulatory requirements with security and ISMS components for resilient operations.
Assessment of whether NIS-2, DORA, CRA, or other EU requirements apply and which specific obligations arise from them.
Comparison of the current security level with regulatory requirements, including a prioritized roadmap.
Establishment or further development of an information security management system with scope, policies, and risk and control structures.
Technical and organizational measures, supply chain security, access rights, emergency planning, and documentation of compliance.
Reporting processes, escalation, documentation, and management responsibility for security incidents.
Continuous reviews instead of one-off project files - with training, audit preparation, and ongoing improvement.
We treat IT security as an ongoing program - with clear steps from the initial assessment through continuous improvement.
Assessment of infrastructure, processes, documentation, risks, and applicable regulatory requirements.
Scope, risk analysis, IAM/PAM, third parties, business continuity, and documentation are brought together.
Management and employees understand responsibilities, reporting channels, and secure working practices.
Preparation for internal and external audits, including evidence and action tracking.
Regular reviews, KPIs, updates, and ISO 27001-aligned support as an ongoing service.
Clarify whether you are in scope and identify the most effective next steps in 30 minutes - with consulting and implementation from a single provider.
