NIS2 is mandatory. Build compliance that proves you're strategic—not reactive.

Essential entities: Higher criticality, stricter requirements, more intensive supervision, larger penalties (€10M or 2% revenue), ex-ante supervision. Important entities: Lower criticality, somewhat lighter requirements, risk-based supervision, smaller penalties (€7M or 1.4% revenue), ex-post supervision. Both are regulated, but essential entities face more stringent obligations and oversight.

Early warning (within 24 hours): Initial notification to national CSIRT/authority that significant incident occurred. Limited information required. Incident notification (within 72 hours): More detailed information—what happened, impact, affected services, mitigation measures. Final report (within 1 month): Complete incident report with root cause analysis, detailed timeline, lessons learned, measures taken. Not every security incident requires reporting—only those meeting specific significance thresholds. We help you build classification criteria.

NIS2 explicitly makes board/executive management responsible for: approving cybersecurity risk management measures, overseeing implementation, participating in mandatory cybersecurity training, ensuring adequate resources. Failure in these duties can result in personal liability. We build framework that gives management visibility and control without making them cybersecurity experts.

Significant overlap: Both address cybersecurity risk management, controls, governance. NIS2-specific additions: 24-hour incident reporting to authorities, supply chain security with specific requirements, management body accountability framework, specific organizational measures, registration with national authorities. If you have ISO 27001, you're 60-70% toward NIS2 compliance. We identify and implement the NIS2-specific gaps.

NIS2 requires: identifying critical suppliers, assessing supplier cybersecurity risks, including security requirements in contracts, monitoring suppliers ongoing, requiring suppliers to notify you of incidents, taking measures to reduce supply chain risk. You're not responsible for supplier security, but you are responsible for managing supplier-related risks. We help you build proportionate, risk-based supplier security program.

Generally: where you're established (headquarters/registered office), where you provide services in EU, where you have significant operations. Multi-country operations can be complex. We analyze your footprint and determine which national authority/authorities regulate you.

Consequences depend on non-compliance severity: Minor issues: Warnings, orders to remedy within timeframe. Significant non-compliance: Administrative fines (up to €10M or 2% for essential entities). Serious failures: Suspension of operations (rare but possible). Management liability: Personal consequences for board members who failed oversight duties. Better to implement systematically now than remediate under enforcement pressure.

Ongoing requirements: continuous operation of all 11 cybersecurity measures, incident monitoring and reporting as required, regular risk assessments and updates, supply chain security monitoring, annual training and awareness, updates when business/technology changes, management reviews and reporting, response to supervisory authority inquiries. Typical effort: 5-10 days per quarter for mature compliance program, plus incident handling as needed.