NIS2 consulting and audit
We establish whether your organisation is an essential or important entity, which of the legal requirements apply to you concretely, and in what order they should be addressed. Then we stay with you through implementation, testing and preparation for supervision.
What you get
Scope is agreed after the initial assessment, so you pay for the work your obligations actually require. Consulting builds the compliance system; the audit measures where you stand against the requirements.
Scope assessment
A documented determination of whether you are an essential entity, an important entity, or outside scope — with the reasoning, so it stands up if questioned. Your business activity code alone does not settle the question, and neither does company size on its own.
Gap analysis
Your current technical and organisational state measured against each applicable requirement, with findings ranked by legal exposure rather than by vendor preference.
- risk management
- internal policies and procedures
- access control
- incident handling
- business continuity
- supply chain security
- incident reporting
- governance and accountability
Documentation
The documents needed for implementation and for demonstrating compliance.
- risk analysis and risk register
- cybersecurity policies
- operational procedures
- incident handling and reporting
- business continuity
- supply-chain assessment
- access control
- asset management
Implementation support
Practical assistance with the technical measures — not just a list of controls handed over, but help getting them in place and evidenced, so that what the procedures describe matches what actually runs in the organisation.
Compliance audit
An assessment of actual readiness, not merely of whether documents exist.
- existing policies and procedures
- technical and organisational controls
- how risk is managed
- incident detection and reporting
- non-conformities and vulnerabilities
- remediation recommendations, prioritised
Inspection readiness
Preparing the evidence file, rehearsing the questions a supervisory authority will ask, and closing the gaps that would show up first.
How it runs
Duration depends on the size of the organisation and the maturity level found during the gap analysis. Stage 1 can be run on its own, as a preliminary check.
Scope
Determining essential or important entity status and the obligations that follow.
Gap analysis
Current state against each legal requirement, technical and organisational.
Documentation
Policies, procedures, risk register, incident response plan, evidence records.
Implementation
Technical and organisational measures, internal responsibilities, supplier assessment.
Audit
Verifying what was implemented and preparing for external supervision.
Deliverables
The documents and records handed over at the end of the engagement. The exact set depends on scope and on the outcome of the gap analysis.
- Scope
- Scope determination report · the list of obligations that apply to your organisation
- Analysis
- Gap analysis report · prioritised plan of measures · audit report with identified non-conformities
- Risk
- Risk register · risk treatment plan
- Documentation
- Cybersecurity policy set · operational procedures · incident response plan · reporting mechanisms
- Governance
- Responsibility matrix · evidence and supporting documents for audit
- Remediation
- Remediation recommendations, ordered by impact and urgency
Why the order matters
Most organisations that come to us have already bought something. The recurring problem is not a lack of tools — it is that nobody established which obligations applied before spending began.
Measures then turn out to be either insufficient against the law or disproportionate to the actual risk. Starting with the scope assessment costs a fraction of what it costs to redo an implementation built on the wrong assumption.
- Management accountability
- Legal responsibility sits with the management bodies and cannot be transferred in full to a provider or to IT.
- Supervision
- Essential entities face proactive supervision; important entities are checked mainly after an incident or complaint.
- Supply chain
- Obligations reach suppliers of regulated entities, which is how many organisations discover they are in scope.
- Training
- Staff and management training is an explicit requirement, not a recommendation.
A useful audit tests operation, not existence
- Risks are identified and treated
- Security measures are actually applied
- Processes are documented
- Incidents are handled and recorded
- Traceability and accountability are in place
- Readiness can be demonstrated, not asserted
After implementation
Compliance is not a project that finishes. Requirements change, suppliers change, incidents happen, and the evidence has to be current on the day an inspector asks for it. If you are still weighing in-house implementation against a consulting project or a standing role, the comparison of the three routes sets out the cost shapes and the criteria.
Consulting and audit
Scope, gap analysis, documentation, plan of measures, risk assessment and procedures. It ends when the compliance system is built.
Outsourced NIS2 officer
For organisations that must designate someone responsible but have no internal resource: monitoring, documentation upkeep and management reporting after the project ends.
Frequently asked questions
01How do I know whether my organisation is in scope?
Three criteria settle it in most cases: the sector (whether it appears in the annexes to GEO 155/2024), the size (at least 50 employees or turnover above EUR 10 million), and your position in the supply chain of an essential or important entity. The business activity code alone is not enough. The scope assessment answers this in writing.
02Can we commission only the audit?
Yes. The compliance audit can be commissioned separately, as an independent check on readiness — including where implementation was done internally or by another provider. The output is a report of identified non-conformities with prioritised remediation recommendations.
03How long does a compliance project take?
It depends on the size of the organisation, the number of sites and the maturity found during the gap analysis. The scope assessment runs quickly and independently; the remaining stages are planned once the gap analysis is complete, against a schedule agreed at the start.
04Is documentation enough for compliance?
No. An audit verifies whether the measures described in the documents are implemented, applied and operationally supported. That is why the engagement covers the technical and organisational side, not only drafting.
05What happens after implementation?
Someone has to keep the system current. Organisations without an internal resource for that can outsource the role through our outsourced NIS2 officer service.
Send us your sector and headcount. We will tell you where you stand.
The preliminary conversation costs nothing. If you are outside scope, we will say so.
- Phone
- +40 763 204 739
- [email protected]
- Response time
- One working day at most