NIS2 compliance assessment
The NIS2 Directive applies from 18 October 2024 through each EU member state’s national law. It sets risk-management measures, strict incident reporting deadlines and personal accountability for management. We assess where you stand against each obligation as your country has implemented it.
Who it is for
- Medium and large organizations in the sectors NIS2 lists, and some smaller ones it covers regardless of size.
- Groups operating in several member states with different national rules.
- Suppliers to NIS2 entities facing new security requirements in contracts.
What we assess
- Applicability: whether you are an essential or important entity, and in which member states.
- The Article 21 measures, from risk analysis and incident handling to supply chain security, multi-factor authentication and cryptography.
- Article 23 reporting: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
- Management body duties: approving the measures, overseeing them, and training.
What you receive
- An applicability memo per member state.
- A gap register mapped to Article 21(2).
- An incident reporting runbook built around the 24-hour, 72-hour and one-month deadlines.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to four weeks for one entity in one member state.
Common questions
What are the fines under NIS2?
Member states must allow fines of at least up to €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher. National law can set them higher.
Does the national law matter?
Yes. NIS2 is a directive, so obligations reach you through each country’s implementing law, and details such as registration and reporting channels differ between them.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
NIS2 assessment
We reply within one business day.
Nothing you send is shared outside Calibre.