NIS-2 · cyber security · extension of KRITIS

NIS-2 is in force — work out whether it applies to you and put the duties and evidence in place now

We establish whether your company is in scope and build risk management, reporting processes, supply chain evidence and board reporting — with personal advice and the ISMS platform.

  • Scope assessment for Annex I/II
  • Full service 4,900 – 16,300 € depending on company size
  • 3–6 months to auditable NIS-2 documentation
  • Setup of your ISMS platform — subscription separate
  • 30 minutes assessment
Have your NIS-2 scope checked Estimate cost & effort
★★★★★ 5.0 from 12+ certified clients · ·
Specialist holding NIS-2 documentation
DQS · TÜV NORD · notivia since 2003 · +50 ISMS clients* · +20 Full-service clients* · 100% Audit success* · ★★★★★ 5.0

* Audit success relates to completed full-service certification projects since 2019. Client numbers include ISMS platform licence holders and full-service projects. Example calculations are typically for SMEs with 5–25 staff.

Quick check

This page is for you if …

  • … you want to know whether NIS-2 applies to you.
  • … you are classed as an essential or important entity .
  • … you need a cyber security concept .
  • … you are classed as an the management board may be personally liable.
  • … you want to know what NIS-2 compliance costs and how long it takes.
Our services for NIS-2

Four building blocks. One route to compliance.

Four clear building blocks — from the first scope assessment to a NIS-2 operation that is documented end to end.

Maximum support

Full-service support

Complete NIS-2 implementation, from the scope assessment to auditable governance documentation.

This suits you if you want NIS-2 compliance with as little internal project load as possible.
  • Scope & sector analysis (Annex I/II)
  • Risk management + business continuity
  • Reporting system (24h/72h) ready to use
  • Supply chain management incl. templates
from €4,900 one-off · M from 9,800 € · L from 16,300 € Start-up up to 5 staff · depends on sector, company size, scope and your existing security level · all prices exclude VAT
Request a quote
Ongoing

External NIS-2 coordinator

Ongoing upkeep, reporting, incident reporting processes and communication with the authorities.

This suits you if you want your NIS-2 compliance maintained and the dealings with the authorities taken off your hands.
  • Reachable when a report is due
  • Reporting to the management board
  • Communication with the authorities
  • Mandatory board training included
from €400 / month
Enquire about consulting
12-month minimum term · 3 months' notice
One-off / yearly

Internal audit

A maturity audit against NIS-2 — so you know where you stand.

This suits you if you want your NIS-2 measures verified before the authorities look at them.
  • NIS-2 maturity score
  • Prioritised action plan
  • Board report
  • Re-audit after 6 months optional
from €3,400 one-off (1 audit day)
Enquire about an audit
Self-service

Build it yourself

Build NIS-2 yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

NIS-2 add-ons for the management board, incident reporting and the supply chain

Bookable individually — made for SMEs not yet ready for full service

Train the board & document the evidence

A half-day NIS-2 course including attendance record and action list — as required by Section 38 NIS2UmsuCG (the German NIS-2 implementation act).

from €890

Incident reporting desk, 24/72h

Support during incidents — early warning, interim and final report.

from €1,490/case

Supply chain risk analysis

A systematic review of your suppliers against the NIS-2 criteria.

from €2,490
Retainer services (external officer, reporting channel): 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

Does NIS-2 apply to you? You will know in 30 minutes

Scope, to-dos and a realistic timeline — in person, without obligation, answered as fast as we can.

Lead consultant
Lead consultant
Your contact
  • The fastest answer we can give
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·The fastest answer we can give·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free NIS-2 check · 2 min

    Does NIS-2 apply to you?

    10 questions on sector, size and field of activity. Know straight away whether NIS-2 is mandatory for you.

    Start the check

    Or do it yourself

    The ISMS platform with its NIS-2 module

    The multi-standard ISMS digitalises NIS-2 risk management, incident reporting and supply chain documentation — without external consulting costs.

    Explore the platform
    Guide · PDF

    NIS-2 guide for mid-sized companies

    What the directive requires, which deadlines apply, what the management board needs to know — explained plainly.

    Download the guide
    CORE REQUIREMENTS

    What NIS-2 asks of you

    The main duties under Art. 21 of the NIS-2 directive

    Risk analysis & security concepts

    Systematic identification, assessment and treatment of cyber risks to your critical systems.

    Handling security incidents

    Processes to detect, report and handle cyber attacks and security incidents.

    Business continuity & crisis management

    Plans for business continuity, backup management and recovery after an incident.

    Supply chain security

    Assessing and securing suppliers and service providers along the whole value chain.

    Security in acquisition, development & maintenance

    Security requirements for procuring, developing and maintaining IT systems and networks.

    Assessing effectiveness

    Regularly reviewing and assessing whether your security measures actually work.

    Cyber hygiene & training

    Basic cyber hygiene practices and regular security training for all staff.

    Cryptography & encryption

    Using encryption and cryptographic methods to protect sensitive data.

    Personnel security & access control

    Access management, identity management and security in HR administration.

    Multi-factor authentication

    Using MFA and secure communication tools for access to critical systems.

    REPORTING DUTIES

    Strict deadlines after a security incident

    1
    Within 24 hours

    Early warning to the BSI

    A first report of the incident to the competent authority — even without a full analysis.

    2
    Within 72 hours

    A detailed report with an assessment

    A detailed description of the incident, a first view of its severity and of the systems affected.

    3
    Within 1 month

    Final report with root cause analysis

    A complete report with root cause analysis, the measures taken and the lessons learned.

    Fines of up to €10 million

    Or 2 % of worldwide annual turnover — whichever is higher.

    Personal liability

    Managing directors and board members are personally liable for meeting the NIS-2 duties.

    The directive in brief

    What has to be in place for ISO 27001?

    Eight building blocks — the mandatory set for NIS-2 compliance.

    1. Risk management & cyber security measures
    2. Supply chain management
    3. Business continuity & crisis management
    4. Incident reporting (24 h / 72 h deadlines)
    5. Training & awareness
    6. Access control & authentication
    7. Incident response process
    8. Board training & managing liability

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    OVERLAP

    ISO 27001 is the basis for NIS-2 compliance

    If you hold a certified ISMS to ISO 27001 you already meet a large part of the NIS-2 requirements.

    NIS-2 requirementCovered by ISO 27001
    Art. 21(a) risk analysis ISO 27001 Klausel 6.1
    Art. 21(b) incident handling ISO 27001 A.5.24–A.5.28
    Art. 21(c) business continuity ISO 27001 A.5.29–A.5.30
    Art. 21(d) supply chain security ISO 27001 A.5.19–A.5.23
    Art. 21(e) security in procurement ISO 27001 A.8.25–A.8.31
    Art. 21(g) cyber hygiene ISO 27001 A.6.3
    Art. 21(j) MFA ISO 27001 A.8.5
    ~70 %
    Overlap between ISO 27001 and NIS-2
    OUR SOLUTION

    Implementing NIS-2 with iso-easy

    1

    Scope assessment

    Establishing whether and how NIS-2 applies to your company — based on sector, size and criticality.

    2

    Gap analysis

    Systematically comparing your existing measures against every NIS-2 requirement and identifying the gaps.

    3

    Build the ISMS

    Implementing ISO 27001 as the foundation and adding the specific NIS-2 extensions.

    4

    Compliant for the long run

    A PDCA operating mode for continuous NIS-2 compliance with regular reviews.

    Risk management Incident reporting workflow Supplier assessment Training records Audit trail Business continuity
    SCOPE ASSESSMENT

    Does NIS-2 apply to your company?

    Highly regulated Essential entities

    • From 250 employees
    • Over €50 million turnover
    • Or over €43 million balance sheet total
    • Sectors of high criticality

    Regulated Important entities

    • From 50 employees
    • Over €10 million turnover
    • Or over €10 million balance sheet total
    • Other critical sectors

    18 sectors in scope

    Energy Transport Banking Healthcare Digital infrastructure Public administration Space Post & courier Waste management Food Chemicals Research Digital services Manufacturing Financial markets Drinking water Waste water ICT services

    Or do it yourself

    The ISMS platform for NIS-2 — and 10 further standards

    Digitalise NIS-2 duties such as risk management, incident reporting and supply chain documentation in a multi-standard ISMS. With an AI copilot, templates and the audit guide — without external consulting costs.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about NIS-2

    What is the NIS-2 directive?
    NIS-2 is an EU-wide cyber security directive and the successor to the original NIS directive. EU member states have had to transpose it into national law since 17 October 2024, and it widens the cyber security requirements considerably.
    Who does NIS-2 apply to?
    Companies from 50 employees or €10 million turnover in 18 critical sectors. Smaller companies can also be in scope if they are classed as critical — providers of DNS or trust services, for example.
    What happens if I do not implement NIS-2?
    Fines of up to €10 million or 2 % of worldwide annual turnover — whichever is higher. On top of that, senior management is personally liable for meeting the security duties.
    Do I need ISO 27001 for NIS-2?
    Not strictly, but ISO 27001 covers around 70 % of the NIS-2 requirements and is a recognised basis for evidencing many of them in a structured way. A certified ISMS is usually the most efficient route to NIS-2 compliance.
    How long does implementing NIS-2 take?
    With our full service, typically 4–8 months, depending on company size and the maturity of your existing security measures. With an ISMS already in place it can be considerably faster.
    Can I implement NIS-2 and ISO 27001 at the same time?
    Yes — it is in fact the most efficient route. Our ISMS covers both standards in one integrated system, which avoids duplicated work and creates a compliance structure that lasts.
    How much internal work does this really mean for us?
    A conventional NIS-2 project swallows 40–60 person-days of internal time. With our approach plus the ISMS platform we bring that down to 15–25 person-days — because we prepare most of the risk analysis, the reporting processes and the supplier assessment for you. Your team reviews, decides and signs off.
    What happens after NIS-2 is implemented? Are there audits?
    Yes. Essential entities are actively supervised by the Bundesnetzagentur (on-site inspections, spot checks). Important entities are examined when there is cause — after an incident, for example. In both cases you need a documented cyber security concept, evidence and training records. With our ISMS platform every piece of evidence is available at any time.
    What happens if we do not pass the internal cyber security audit?
    Depending on the nature and severity of the finding, the authorities can require evidence, measures or remediation . Repeated or serious breaches can additionally bring fines, public disclosure and, in the extreme, a ban on the activity. Our approach — gap analysis plus an internal review before any inspection — reduces the risk of gaps and prepares you systematically for evidence requests and possible inspections.
    What is the difference between an "essential" and an "important" entity?
    Essential entities are the systemically relevant sectors (energy, water, banking, health, IT infrastructure) from 250 staff — with active supervision. Important entities are the further critical sectors (post, food, mechanical engineering, IT service providers) from 50 staff — supervised when there is cause. The duties are very similar; the intensity of supervision differs. Our scope assessment settles your classification.
    Is ISO 27001 enough, or do we still need NIS-2?
    ISO 27001 covers ~60–70 % of the NIS-2 requirements — a very good base. But NIS-2 additionally requires: 24/72-hour incident reporting processes, supply chain risk management to the EU specification, documented board training and communication with the authorities. With ISO 27001 in place, expect 30–40 % additional effort for full NIS-2 compliance.