Offensive Services
Tailored offensive services from neonotu. Ethical hacking, penetration tests and red team operations for maximum protec…
ViewDefensive Services
NIS2 consulting for companies
Germany's NIS2 Implementation Act has been in force since 6 December 2025. The federal government estimates that around 29,500 companies fall under it, most of them for the first time. We work out with you whether and how you are affected, where you stand today and which measures come first. Then we implement them together.
01
Scope
Does NIS2 apply to your company?
The law covers 18 sectors. Besides energy, health and transport, they include machinery manufacturing, food production, chemicals, waste management and postal and courier services. A company is usually covered from 50 employees, or from 10 million euros in both annual turnover and balance sheet total. From 250 employees, or from 50 million euros in turnover with a balance sheet above 43 million euros, it usually counts as an essential entity, with stricter supervision and higher fines.
The classification depends on details. What matters is the activity your company actually carries out, and within a group the figures of affiliated companies may count as well. Some firms are covered through a side business nobody thought of. Others fall outside despite their size.
Companies outside the law often feel NIS2 anyway. Customers who are covered must secure their supply chain, and they pass requirements on to suppliers and service providers, usually as a questionnaire or a contract clause.
- 24 hours
- for the early warning to the BSI
- 72 hours
- for the incident notification
- 1 month
- for the final report
- 50 employees
- the point where the law can apply
Audience
Who the consulting is for
01
Management board and managing directors
the law requires you to approve the measures and oversee their implementation. You are liable for breaches of duty and must attend training regularly.
02
IT management and information security
you need a plan that works with the people you have, and arguments for the budget.
03
Compliance and legal
you have to show the BSI and your customers what has been implemented.
04
Suppliers to covered companies
you receive requirements and want to know which of them are really necessary.
Process
How we work
The order follows the deadlines. What the law demands soonest comes first.
For management training, our Cybersecurity Governance for Executive Leadership workshop is a good fit. Technical checks such as a penetration test show whether the measures work, and for your staff there is our security awareness training.
- 01
Check the scope. We assign your company to a sector, check the thresholds and record the classification in writing. Where needed, we support the registration with the BSI.
- 02
Gap analysis. We compare your current state with the risk management measures in section 30 of the BSI Act. To do this we talk to IT, business units and management and review existing documents and systems.
- 03
Action plan. Every gap gets a risk-based priority, a responsible person and a deadline. Management can see what is due by when.
- 04
Reporting chain. A significant security incident must be reported to the BSI within 24 hours. We define who detects it, who decides and who reports, and we run through the process once.
- 05
Involve management. We prepare the resolutions for approval and train the management team as the law requires.
- 06
Implement and verify. We support the implementation and check whether the measures work.
Deliverables
What you have at the end
The documents belong to you. We write them so that your team can keep working with them without us.
- 01
a written classification of whether you are covered, with reasons
- 02
the gap analysis report, structured by the requirements of section 30 of the BSI Act
- 03
a prioritised action plan with owners and deadlines
- 04
drafts of the policies NIS2 requires, for example on risk management, incident handling, contingency planning and the supply chain
- 05
the reporting chain with templates for early warning, notification and final report
- 06
draft resolutions for management
02
Scope of service
Consulting and software: who does what
The consulting settles what needs doing and gets the implementation moving. After that, evidence keeps coming in: training records, audit reports, resolutions, customer questionnaires. Sightadel keeps that evidence from ending up scattered across folders and inboxes again.
Sightadel is our platform for information security and compliance. NIS2, ISO 27001 and DORA are stored there as catalogues, and a piece of evidence can be filed once and mapped to several requirements. You do not need any software to work with us. If you use Sightadel, though, the results of the consulting land in the right place straight away.
03
Standards
NIS2 and ISO 27001
If you already run an ISMS to ISO 27001, a large part of the work is done, because the measures overlap widely. Some points are unknown to the standard: registration with the BSI, the statutory reporting deadlines and the duties of management. We close these gaps specifically, without rebuilding your ISMS.
If you do not have an ISMS yet, NIS2 is a good reason to build one. It takes longer, but it creates a foundation that customers and insurers recognise too. More on the ISMS implementation page.
There is no official NIS2 certificate, by the way. You demonstrate implementation to the BSI with your own documents when the authority asks for them.
04
Ongoing
After the project
NIS2 requires you to check the effectiveness of your measures regularly. Many companies have nobody in house to do it. Our virtual CISO takes on this role as a subscription, with a minimum term of six months. If you prefer a fixed contact person with a set number of hours, the external CISO is the better fit.
Tell us your industry and how many people you employ. In a first call we will tell you whether NIS2 applies to you and where you should start.
FAQ
Frequently asked questions
Do we have to register with the BSI?
Yes, if the law applies to you. Registration runs through the BSI portal. For companies covered when the law came into force, the deadline ended in early March 2026. If you missed it, register now. If you only fall under the law later, you have three months from that point.
Is management personally liable?
Yes. Under section 38 of the BSI Act, management must approve the measures and oversee their implementation. If it breaches these duties, it is liable to the company. It must also attend training regularly.
How high are the fines?
For essential entities up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. For important entities up to 7 million euros or 1.4 percent.
Is our ISO 27001 certificate enough?
It covers a lot, but not everything. Registration, reporting deadlines and the duties of management come on top. The gap analysis shows what exactly is missing in your case.
We are not covered, but our customer still wants evidence. What now?
That happens a lot. We check with you which of the customer's requirements follow from NIS2 and which go further, and we help you answer the questionnaire in a way that holds up.
Defensive Services
More in this area
Defensive Services
Strengthen your digital defense with precisely fitted defensive services. AI-driven threat detection, quantum encryptio…
ViewDigital Forensics
Making invisible traces visible. Highly specialized analysis, AI-driven behavioral forensics and AR visualization for m…
ViewWorkshops
Strengthen your IT security with interactive cybersecurity and defense workshops. Hands-on training for effective defen…
ViewPackages & Subscriptions
Tailored cybersecurity subscriptions: from recurring pentests to a vCISO. Flexible security solutions for lasting prote…
ViewContact
Reputation takes years. Destruction takes seconds.
Talk to us before somebody else does. The first conversation is free and we reply the same business day.