NIS-2

NIS-2, implemented with legal certainty.

Clarify scope, implement obligations, set up reporting channels.

To the package ↓

What we deliver

From obligation to advantage.

We determine whether you qualify as an essential or important entity under the NIS-2 Directive and the amended German IT Security Act (BSIG), set up risk management and reporting processes, and support implementation of the technical and organisational minimum requirements.

  • Scope assessment by sector, size and supply-chain role
  • Gap analysis against the NIS-2 minimum requirements
  • State-of-the-art risk management measures
  • Reporting process for significant incidents (early warning 24 h, notification 72 h, final report after one month)
  • Management training on personal liability

How we work

From classification to the reporting channel.

  1. Step 01

    Scope assessment

    We assess sector, company size and supply-chain role and classify you as an essential, important or non-affected entity.

  2. Step 02

    Gap analysis

    We compare the current state of your IT security against the NIS-2 minimum requirements.

  3. Step 03

    Implementation & reporting

    We set up risk management measures and the reporting process for significant incidents and train your management on personal liability.

Your Invest

One package, clearly calculable.

A flat fee for the binding classification, with implementation support bookable as an option.

NIS-2 impact analysis

from € 1,000 flat fee

excl. VAT

Price depending on sector, size and number of sites

Scope of services

  • Review of sector and company size
  • Assessment of the role in the supply chain
  • Binding classification as an essential, important or non-affected entity
  • Written documentation of the result

Optional

  • Implementation support on request
Request NIS-2 impact analysis →

NIS-2 & BSIG

Cybersecurity, now required by law.

The NIS-2 Directive considerably widens the circle of regulated companies and is implemented in Germany through the amended IT Security Act (BSIG). Far more than classic IT firms are affected, from energy and health to waste management and manufacturing. Affected companies in Frankfurt am Main and the Rhine-Main region we support on site, and across Germany remotely.

Who is affected

Sector and company size are decisive: the law distinguishes between essential and important entities. Suppliers are increasingly drawn in via supply-chain clauses too, even without being directly in scope.

The core obligations

  • State-of-the-art risk-management measures (Art. 21 NIS-2)
  • Reporting of significant incidents (early warning within 24 h, notification within 72 h)
  • Personal responsibility and liability of management (Art. 20 NIS-2)
  • Security requirements for the supply chain

Assess first, then implement

A robust exposure analysis comes first. Our free NIS-2 check gives an initial orientation; we then support the binding classification and implementation.

A negative result has value too. You receive a documented classification that you can present to your management, your clients and your insurer.

More services

What else we cover.

From the blog

Further reading on the topic.

Are you in scope of NIS-2?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What clients ask about being in scope.

Is NIS-2 directly applicable law in Germany?
No. NIS-2 is an EU directive (EU 2022/2555) that member states must transpose into national law. In Germany this happens through the amended IT Security Act (BSIG) under the NIS2UmsuCG, which sets out the concrete obligations, fines and reporting channels for German companies.
How does the NIS-2 review work?
First we carry out the scope assessment: we evaluate sector, company size and supply-chain role and classify you as an essential, important or non-affected entity. If you are affected, we compare the current state of your IT security against the NIS-2 minimum requirements (gap analysis). On request we then support implementation: risk management measures, the reporting process for significant incidents, and training for management.
How does the consulting differ from the free NIS-2 check?
The free NIS-2 check gives an instant self-assessment in three questions. Consulting goes deeper: classification, gap analysis and support implementing the technical and organisational measures.
By when must a security incident be reported?
An early warning is due within 24 hours of becoming aware, a full notification within 72 hours, and a final report no later than one month after notification.
What fines and penalties are possible?
Essential entities: up to €10 million or 2 % of worldwide annual turnover. Important entities: up to €7 million or 1.4 % of worldwide annual turnover. Whichever amount is higher applies. On top of that, management bears personal responsibility for implementing the risk management measures.