NIS2
Do not wait for a NIS2 designation letter
NIS2 obligations follow from the law, not from a letter from the authority. How to check whether you are in scope and what to prepare now.
Discuss your caseWhat matters
- NIS2 (EU cybersecurity directive) required Member States to establish a list of essential and important entities by 17 April 2025 (Art. 3(3)), and entities must provide their details to the authorities (Art. 3(4)).
- Transposition and designation run at different speeds across the EU; in some countries the list is still being drawn up.
- The obligations — management-approved measures, training and incident reporting — follow from the national law, not from a letter. Waiting for the letter leaves less time to prepare.
- National details (authority, deadlines, categories) depend on the Member State; in Bulgaria, for example, see NIS2 in Bulgaria.
Start by checking scope
Check whether you are in scope
A written conclusion: in scope or not, essential or important, which authority.
from €900
What is included →Then choose one of two options
Stand-alone assessment
The required measures against what you have, gaps and an ordered plan for management.
from €7 900
What is included →Assessment and support for the year
Annual programme: the assessment plus 12 months of an external expert role in one contract.
€24 700
What is included →The annual programme includes the assessment — you do not need to commission both options.
A free two-minute self-check shows whether NIS2 is likely to apply to you. Not sure which sector you are in? See the NIS2 sectors or how applicability is checked.
General information, not a legal opinion. Legal questions are commissioned separately from a lawyer.