European NIS2 Directive

Impact Analysis

Important note: The authorities will not inform you whether your company is affected by NIS-2. Your company or institution must assess itself based on criteria that include both industry elements and size considerations. If an organization with a large market share in a particular sector is “important”, it may even be classified as “essential” due to its size.

Learn more (German)

Gap Assessment with Roadmap

Using a structured approach – consisting of a kick-off meeting, interviews, and on-site inspections – we analyze your current level of cyber security maturity in comparison with the requirements of the NIS 2 Directive. As a result, you will receive specific recommendations for action and a roadmap for implementing the necessary measures.

NIS-2 Compliance of the EU

EU member states are implementing NIS 2 with varying degrees of strictness, particularly with regard to national requirements, fines, and exemptions. Many companies with multiple EU entities are therefore faced with the question of how to achieve compliance in a uniform, cost-efficient, and realistic manner.

We support you with a comprehensive impact analysis for all your EU entities. We identify which entities in which countries must comply with NIS 2 obligations, conduct a gap assessment for each of these entities, and develop a harmonized, consolidated roadmap. This enables you to achieve compliance with minimal effort, optimized costs, and in the shortest possible time.

NIS-2 Implementation

You are affected by NIS-2 and have already carried out a gap assessment – what now? The key challenge is to close the identified gaps systematically and in order of priority. This is exactly where we come in:

Based on the recommendations of ENISA and the results of your roadmap, we support you in implementing all necessary measures – strategic, organizational, procedural, and technical.

These include, among others:
 

• Establishing clear governance and accountability structures 
• Establishing and implementing security policies and processes
• Technical measures such as monitoring, logging, incident response, and reporting in accordance with NIS-2
• Integration of supply chain and service provider requirements
• Implementation of awareness and training measures for employees
• Anchoring of business continuity and disaster recovery plans

The end result is the sustainable implementation of your roadmap, so that your company not only becomes formally NIS 2-compliant, but also achieves a higher level of maturity in cybersecurity – cost-effectively and in a practical manner. 

More on defining areas of responsibility: 

The increased requirements for risk management and resilience mean that your organization must be able to deal with risks and implement both damage prevention and damage minimization measures to reduce risks and impacts. Appropriate measures are expected in areas such as incident management, cybersecurity in supply chains, network security, risk management, access control, and encryption. 

More on setting up reporting requirements: 

Organizations must have procedures in place to ensure that security incidents are reported to the authorities in a proper manner. To this end, the four-stage reporting process must be followed: Stage 1 – early initial report, Stage 2 – confirmatory initial report, Stage 3 – interim report, Stage 3a – progress report, and Stage 4 – final report. Additional reporting for operators of critical facilities: Type of facility, critical facility or service affected, and the impact. 

But do you know what constitutes a significant security incident? Who is responsible for reporting it? What needs to be reported? Do data protection officers and lawyers need to be involved in the reporting process? And how does their involvement jeopardize timely reporting? We can help you comply with the reporting procedure.

NIS-2 Executive Management Training

According to § 38 BSIG-E, the leadership board in your company must be familiar with the requirements of the directive and the risk management measures. They are directly responsible for ensuring that cyber risks are identified and addressed and that the requirements are met.

We offer leadership training in the following formats:

• Intensive workshop (1–2 days): Our NIS 2 experts work with your relevant stakeholders to develop the technical and organisational requirements of the directive in detail. In addition, we develop an initial evaluation of your cybersecurity landscape (including OT security) and provide you with a clear overview of the status quo immediately afterwards.
• Compact training (half day): In this format, we sensitise your C-level executives and decision-makers to the requirements, strategic implications, obligations, and risks of the NIS 2 directive – in a concise and practical manner. 
• Remote workshop (distributed training): After a one-hour kick-off session with key information about NIS 2 and the resulting obligations for your organisation and its management, we empower all relevant stakeholders in four 30-minute remote sessions on risk management measures and their assessment. For maximum learning effect, we conclude with two half-hour Q&A sessions.

Compliance as Managed Service

Beyond NIS 2 compliance, we offer you extended compliance managed services: We analyze industry-specific regulations and standards, identify existing gaps, and define appropriate measures to close them. Since many regulations require recurring evidence, we ensure that your company is compliant, audit-ready, and well prepared for external audits at all times. 

To this end, we develop continuous control and monitoring mechanisms to ensure the long-term effectiveness of your measures. Together with you, we implement procedures that enable ongoing verification and documentation.