Achieve NIS-2 compliance – structured, practical, and sustainable

SMEs benefit most from a clear and pragmatic roadmap. Key steps include:

• Assess whether the organisation falls under NIS‑2
• Define roles and responsibilities
• Conduct a risk assessment
• Implement security measures according to the EU Implementing Regulation
• Establish incident reporting processes
• Train the management team
• Evaluate the supply chain
• Complete the registration with the national authority

Yes. The number of employees is only one criterion. Other factors include:

• Whether the organisation operates in a regulated sector
• Annual turnover or balance sheet total above EUR 10 million
• Operation of critical infrastructure

Even smaller companies can fall under NIS‑2 if they meet sector or financial thresholds.

NIS‑2 consulting helps organisations implement the requirements efficiently and with minimal internal effort. Typical services include:

• Determining whether the organisation is in scope
• Conducting a gap analysis
• Developing an action plan
• Building a lightweight ISMS
• Supporting registration and reporting processes
• Coaching the management team
• Assessing supply chain risks

Coaching is ideal for SMEs without dedicated security teams. It typically covers:

• Step‑by‑step guidance through the compliance process
• Templates for risk assessments, policies and procedures
• Audit preparation
• Incident and crisis exercise scenarios
• Management training

All individuals who are legally appointed to manage the organisation - regardless of their functional area - must be trained. Executives located outside the EU may also require training if the organisation provides services within the EU.

No. However, NIS‑2 requires a comprehensive risk management approach, which is similar to an ISMS in many aspects. For SMEs, a lightweight, pragmatic ISMS is usually sufficient, as long as it covers the entire organisation.

The reporting deadlines are clearly defined:

• Early warning: within 24 hours of becoming aware of the incident
• Incident notification: within 72 hours
• Final report: within one month

The reporting deadline starts when the organisation becomes aware of the incident, not when the incident occurs. If an incident happens over the weekend but is discovered on Monday, the 24‑hour period begins on Monday.

Yes. Organisations must provide IP address ranges that are clearly attributable to them. This typically refers to static IP ranges, not individual dynamic addresses.

Large cloud providers such as Microsoft Azure, Amazon Web Services (AWS) and Google Cloud are often referred to as hyperscalers. They operate globally distributed data centres and provide IT resources at massive scale.

They are relevant for NIS‑2 because many organisations — including SMEs — rely on them for IT services. This makes them part of the supply chain, which must be assessed under NIS‑2. While hyperscalers are not automatically NIS‑2‑certified, they provide extensive security documentation and certifications that support your own compliance.

Yes. Several providers offer ready‑made scenarios and exercise concepts. For SMEs, compact and realistic exercises that combine technical and organisational aspects are particularly effective.

Yes. If an incident has cross‑border effects, organisations must report it to the relevant authorities in each affected country. Reports must be submitted where the incident occurred and where its impact is felt.