NIS2 compliance assessment

What is NIS2?

NIS2 (Directive (EU) 2022/2555) is the EU’s cybersecurity law for essential and important entities. Each Member State has transposed it into national law, with supervision by national cybersecurity authorities.

NIS2 requires organisations to:

• take appropriate technical, operational and organisational cybersecurity risk-management measures (Article 21);
• have those measures approved and overseen by the management body, whose members must be trained (Article 20);
• report significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23);
• manage cybersecurity risk in their supply chain.

Fines can reach EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% for important entities.

Who must comply?

NIS2 covers medium and large organisations in 18 sectors, including energy, transport, banking infrastructure, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing and digital providers. Some entities, such as DNS and trust service providers, are covered regardless of size.

Suppliers of these organisations are also affected: customers covered by NIS2 must assess the security of their suppliers and will ask for evidence.

What does the assessment cover?

We assess your organisation against the ten areas of Article 21 and the governance and reporting duties of NIS2:

• risk analysis and information security policies;
• incident handling and incident reporting procedures;
• business continuity, backup management and crisis management;
• supply chain security;
• security in acquisition, development and maintenance, including vulnerability handling;
• assessing the effectiveness of security measures;
• cyber hygiene and cybersecurity training;
• cryptography and encryption;
• human resources security, access control and asset management;
• multi-factor authentication and secured communications;
• management body approval, oversight and training.

How does it work?

1. Scoping: we confirm whether NIS2 applies, your likely classification (essential or important) and the services in scope.
2. Document review: policies, risk assessments, incident procedures, supplier controls.
3. On-site or remote assessment: interviews and evidence sampling.
4. Report: findings per requirement, rated by compliance level, with the evidence reviewed.

The result shows clearly what meets NIS2 and where gaps remain. As an independent certification body, we assess and report; we do not design or implement your measures.

NIS2 and ISO 27001

An ISO 27001 information security management system covers much of NIS2, but not all of it. NIS2 adds specific incident-reporting deadlines, management accountability and sector-specific rules. Organisations certified to ISO 27001 can combine the NIS2 assessment with their surveillance audit to save time.

Why choose a NIS2 assessment?

By choosing a NIS2 compliance assessment, you will:

• know whether NIS2 applies to you and in which category;
• have independent evidence for your management body, supervisory authority and customers;
• identify gaps before an inspection or an incident reveals them;
• answer supplier security questionnaires with confidence;
• build on your existing ISO 27001 or ISO 22301 system.