European NIS2 Directive

Impact Analysis

Important note: The authorities will not inform you whether your company is affected by NIS2. Your company or institution must assess itself based on criteria that include both industry elements and size considerations. If an organization with a large market share in a particular sector is “important”, it may even be classified as “essential” due to its size.

Learn more (German)

Gap Assessment with Roadmap

First, we assess the impact and scope, review relevant documentation and plan interviews and on-site inspections. We carry out a systematic assessment against NIS2 in line with your requirements (organisational and technical), drawing on standards such as ISO/IEC 27001, NIST CSF 2.0 or BSI ‘IT-Grundschutz’. From this, we identify specific areas for action, organise gaps into a gap analysis list and prioritise measures according to risk, impact and effort – including quick wins, responsibilities, timelines and resources. The results are a clear overview of your maturity level and an actionable roadmap. The process concludes with management/board briefings on obligations, liability and sanctions, setting out clear next steps; on request, we support implementation through a PMO and prepare internal audits.
 

Method and results:

• Kick-off: Impact, scope, objectives and assessment criteria
• Document review: Policies, processes, contracts and SLAs
• Interviews and on-site visits: IT/OT, business units, service providers
• Assessment framework: Readiness check and comprehensive gap analysis in accordance with NIS2 (based on ISO/IEC 27001 and BSI ‘IT-Grundschutz’)
• Areas under review: Governance, roles/escalation, ISMS, risk analysis including business impact, incident management and regulatory reporting channels, supply chain/third-party risks, network security, IAM/PAM, logging/monitoring, vulnerability and patch management, integration with BCM/KAEP
• Results: Maturity heatmap, gap list, prioritised measures (risk/impact/effort), quick wins
• Roadmap: Responsibilities, timetable, resources and rough investment estimate
• Management/Board briefings: Obligations, liability, sanctions and clear next steps
• Optional support: PMO/implementation support, internal audits and post-audit action management

Does the NIS2 Directive apply to your organisation?
Find out with our scoping tool (German).

NIS2 Compliance of the EU

EU member states are implementing NIS2 with varying degrees of strictness, particularly with regard to national requirements, fines, and exemptions. Many companies with multiple EU entities are therefore faced with the question of how to achieve compliance in a uniform, cost-efficient, and realistic manner.

We support you with a comprehensive impact analysis for all your EU entities. We identify which entities in which countries must comply with NIS2 obligations, conduct a gap assessment for each of these entities, and develop a harmonized, consolidated roadmap. This enables you to achieve compliance with minimal effort, optimized costs, and in the shortest possible time.

NIS2 Implementation

You are affected by NIS2 and have carried out a gap assessment – what next? The challenge is to close these gaps in a structured, risk-based and efficient manner. This is precisely where we come in: based on your roadmap and ENISA recommendations, we prioritise measures and embed them within an effective ISMS. In doing so, we align ourselves with the requirements of relevant frameworks, such as ISO/IEC 27001 (including Annex A controls), NIST CSF 2.0 or BSI IT-Grundschutz (e.g. ORP, CON, DER, OPS, NET, SYS) – to ensure robust governance, clear responsibilities and verifiable controls. We establish policies and processes, professionalise risk and supply chain management, set up monitoring/logging, incident response and reporting channels to regulatory authorities, and strengthen awareness as well as business continuity and disaster recovery. The result: NIS2 compliance, increased resilience and a measurably higher level of security maturity – practical and cost-effective.

These include, among others:

• Governance and accountability structures (RACI, roles such as ISB/CISO)
• Policy framework and process map based on established frameworks and standards
• Technical measures: monitoring, logging, vulnerability and patch management, incident response, reporting
• Supply chain and service provider management, including due diligence and contractual clauses
• Awareness and training programme for staff and management on business continuity and disaster recovery, including exercises and lessons learnt
• KPI/KRI-based reporting to management, supervisory bodies and regulatory authorities

Tools and templates:

• NIS2 ↔ ISO/IEC 27001 ↔ NIST CSF 2.0 ↔ BSI ITGrundschutz mapping matrix and control catalogue
• ISMS documentation set (policies, standards, SOPs, playbooks)
• Risk analysis: Methodology and templates (e.g. ISO/IEC 27005) including a backlog of measures and prioritisation
• Incident and reporting playbooks, regulatory reporting templates and communication guidelines
• Supply chain assessment checklists (onboarding, monitoring, recertification)
• KPI/KRI dashboard and audit preparation kit

More on defining areas of responsibility: 

NIS2 requires enhanced risk management and resilience. We define clear responsibilities (e.g. management obligations, ISB/CISO, risk owners) and put in place appropriate measures in areas such as disruption and incident management, supply chain security, network security, access controls and encryption – derived from ISO/IEC 27001 Annex A, NIST CSF 2.0 and the BSI IT-Grundschutz modules. This ensures that prevention, detection and response are managed holistically and in a verifiable manner.

More on setting up reporting requirements: 

Organisations need procedures to ensure that reports are submitted in a timely and proper manner. We are setting up a multi-stage reporting process:

1. Early warning (initial assessment),
2. Incident notification (details and impact),
3. Interim/progress reports,
4. Final report. Criteria for ‘significant’ incidents and roles (IT/OT, ISB/CISO, data protection, legal, communications) are set out in a binding manner.

Operators of critical infrastructure may be required to provide additional information. We can assist with thresholds, triage, documentation that meets regulatory requirements, and the seamless integration of data protection and legal departments – without jeopardising deadlines.

NIS2 Executive Management Training

According to § 38 BSIG section 3, the leadership board in your company must be familiar with the requirements of the directive and the risk management measures. They are directly responsible for ensuring that cyber risks are identified and addressed and that the requirements are met.

We offer leadership training in the following formats:

• Intensive workshop (1–2 days): Our NIS2 experts will work with your relevant stakeholders to map out the technical and organisational requirements of the directive in detail. In addition, we carry out an initial assessment of your cyber security landscape (including OT security) and provide you with a clear overview of the current situation immediately afterwards.
• Hybrid training (1 hour on-site, in-depth sessions remotely): During the on-site session, our NIS2 experts explain the fundamentals of the NIS2 Directive and its national implementation. Building on this, we address risk management measures tailored to your organisation.
• Compact training (half a day): In this format, we raise awareness amongst your C-level executives and decision-makers regarding the requirements, strategic implications, obligations and risks of the NIS2 Directive – in a concise and practical manner.
• SCORM model (computer-based training): Through short, 30-minute learning modules spread over the course of a year, we deliver the full content of the senior management training in a step-by-step and practical manner to ensure compliance with all regulatory requirements.

Compliance as Managed Service

Beyond NIS2 compliance, we offer you extended compliance managed services: We analyze industry-specific regulations and standards, identify existing gaps, and define appropriate measures to close them. Since many regulations require recurring evidence, we ensure that your company is compliant, audit-ready, and well prepared for external audits at all times. 

To this end, we develop continuous control and monitoring mechanisms to ensure the long-term effectiveness of your measures. Together with you, we implement procedures that enable ongoing verification and documentation.

Technical NIS2 support

We translate NIS2 into effective technical measures – structured, prioritised and verifiable. Based on a technical readiness analysis, we develop a target vision for the security architecture and a actionable backlog of measures. We harden systems and endpoints, segment networks, test firewalls and improve identity and authorisation models. We establish robust security standards for the cloud, containers and Active Directory. At the same time, we set up logging, monitoring and use cases, prepare SIEM/SOC environments and test their effectiveness using EDR/XDR checks and attack simulations. Continuous vulnerability management, patch management and penetration tests efficiently close gaps. Incident detection and regulatory reporting and escalation procedures are integrated. We provide technical evidence, retesting and management dashboards – right through to coordinated managed technical security services.
 

Technical service modules (extract):

• Secure Architecture Review and Security Architecture Target State
• Network Security Analysis, Network Segmentation Analysis, Firewall & Policy Review
• System/Server Hardening Reviews, Secure Configuration Baseline Review, Client/Endpoint Security Assessment
• Active Directory Security Review, Identity & Access Management Review, Privileged Access Management Review
• Cloud Security Assessment (IaaS/SaaS), Container & Kubernetes Security Review, Backup & Recovery Security Review
• Logging & Monitoring Assessment, SIEM and SOC Readiness Checks, Detection Use Case Analysis
• EDR/XDR Effectiveness Testing and Incident Detection Tests
• Internal/External Vulnerability Analyses, Continuous Vulnerability Management, Patch Management Review
• Penetration tests (infrastructure, web, API, mobile), red and purple team exercises, attack simulations along kill chains
• OT and IoT security assessments
• Incident management process design, reporting and escalation procedures in accordance with BSI
• Mapping of technical measures against NIS-2, preparation of technical evidence/documentation, retesting and proof of effectiveness
• Security tool landscape review, zero-trust readiness check, threat modelling workshops
• Technical management reporting and dashboards, as well as managed technical security services (coordinated)

Expert opinion
 

NIS2 not only raises the bar for cybersecurity measures; it also places greater emphasis on their effectiveness and verifiability. In future, organisations must be able to demonstrate that their technical, organisational and procedural measures are appropriately designed and comply with regulatory requirements.
 

An expert opinion provides support precisely in this regard. It delivers an independent and robust assessment of the maturity level of NIS2 compliance and can serve as formal evidence for regulators, customers, business partners or other third parties. It therefore does not primarily address the implementation of individual measures, but rather the question of how well the NIS2 requirements are already being met and how convincingly this can be demonstrated.
 

An expert opinion offers several advantages for organisations. It provides transparency regarding the current state of implementation, strengthens governance in the area of information security and helps to prioritise areas requiring action in a targeted manner. Furthermore, it can act as a signal of trust in the market, particularly towards customers and partners who themselves fall under NIS2 as ‘important’ or ‘particularly important’ entities and who rely on an end-to-end compliance chain within their supply and value chains.
 

It is important to draw a clear distinction here: an expert opinion is not an implementation project. It does not replace the introduction of an information security management system, nor does it replace the implementation of specific technical measures or tools. Rather, it independently assesses the current status quo, identifies gaps in relation to the NIS2 requirements and results in a clear statement on the maturity level of NIS2 compliance.
 

The report is typically produced as part of a five-stage structured process: first, the current status is assessed in workshops and the existing documentation is reviewed. This is followed by a fit-and-gap analysis comparing the NIS2 requirements with the current level of implementation. On this basis, areas for action and measures are identified. The process concludes with an expert opinion serving as an independent assessment, providing a clear statement on NIS2 compliance and on further development needs.
 

In this way, regulatory uncertainty is transformed into robust evidence, and NIS2 compliance becomes a strategic contribution to trust, resilience and competitiveness.
 

What would you like to provide the auditor with? Get in touch now