Skip to main content
Contact Us

NIS2 compliance · European Union

NIS2 compliance, with evidence to prove it

We confirm whether NIS2 applies to you, close the gaps against Article 21 and prepare the evidence a supervisor will ask for.

Get a free readiness check Does NIS2 apply to you?
NIS2 · Article 21(2)EU 2022/2555

Ten measures every in-scope entity must take

  1. (a)Risk analysis & policies
  2. (b)Incident handling
  3. (c)Business continuity
  4. (d)Supply chain security
  5. (e)Secure development & maintenance
  6. (f)Effectiveness assessment
  7. (g)Cyber hygiene & training
  8. (h)Cryptography
  9. (i)Access control & assets
  10. (j)MFA & secure communications
Each measure mapped to evidenceAudit-ready
01 · Scope

Does NIS2 apply to you?

Two questions give you a first answer. Your sector comes from the directive’s annexes, your size from the EU definition of small and medium enterprises.

Simplified from Articles 2 and 3. EU countries can designate more entities, so confirm with a readiness check.

1 · Your sector
2 · Your size
Your result

Pick your sector and size

You’ll see your likely entity type and what it means.

Confirm your scope with an expert
02 · Reporting clock

Three reporting deadlines for one incident

NIS2 sets the timeline from the moment you become aware of a significant incident.

0 h

You become aware

Your team detects a significant incident.

24 h

Early warning

To your CSIRT or competent authority.

72 h

Incident notification

Initial assessment of severity and impact.

1 mo

Final report

Root cause, mitigation and cross-border impact.

We build the workflow and templates for each deadline. To spot incidents in time, day or night, pair it with Q-SOC, our 24/7 SOC.

Build your reporting workflow
03 · Article 21

Ten measures, four groups

What we put in place for each group.

(a)(f)(g)

Governance and risk

Risk analysis, security policies, control reviews and training for staff and management

(b)(c)

Incidents and continuity

A 24h / 72h reporting workflow, backup, recovery and crisis plans

(d)(e)

Suppliers and development

Supplier risk assessments, vulnerability handling and penetration tests

(h)(i)(j)

Access and encryption

Access reviews, asset inventory, MFA and an encryption policy

Management must approve these measures and complete training (Article 20). Our NIS2 compliance checklist lists the evidence for each one.

Get a free readiness check
04 · How we work

From first review to supervisor-ready

01Typically 2–4 weeks

Readiness assessment

Where you stand, in plain terms.

  • Applicability under Annex I and II
  • Controls checked against Article 21
  • Gaps ranked by risk
  • You get: gap analysis and roadmap
02Scoped to your gaps

Implementation

We close the gaps with your team.

  • Policies, procedures and governance
  • 24h / 72h / 1-month reporting workflow
  • Segmentation and access control, including FortiGate deployment
  • You get: audit-ready documentation
03Ongoing

Continuous assurance

Compliance that stays defensible.

  • Regular control checks
  • Evidence kept in one place
  • Support during supervisory checks
  • You get: updates as national rules change

Want a score before you talk to anyone?

Our free NIS2 self-assessment toolkit rates your readiness requirement by requirement.

Try the self-assessment
05 · Questions

NIS2 compliance FAQ

Get a free readiness check
Who does NIS2 apply to?
Medium and large organisations in the 18 sectors listed in Annexes I and II of the directive. Some entities are in scope at any size, such as DNS providers and qualified trust service providers. Suppliers feel it through their customers' contracts.
What's the difference between essential and important entities?
Essential entities are mainly large organisations in Annex I sectors. They face proactive supervision such as audits and inspections. Important entities are the rest of those in scope, supervised after the fact. Both must take the same Article 21 measures.
What are the NIS2 fines?
Essential entities: up to €10M or 2% of global annual turnover, whichever is higher. Important entities: up to €7M or 1.4%. Authorities can also order corrective measures and hold management to account.
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the notification.
Is management personally responsible under NIS2?
Yes. Under Article 20, management bodies must approve the cybersecurity risk-management measures, oversee how they're implemented and complete training. They can be held liable for breaches.
How does the free NIS2 readiness check work?
Tell us about your organisation in the form below. We review your environment and send you a gap overview with a practical roadmap. The full readiness assessment goes deeper.
Does NIS2 apply to our suppliers?
Article 21 requires in-scope entities to manage supply chain security, so they assess their suppliers and add security clauses to contracts. Our supplier risk assessment template shows what they ask.
Free readiness check

Start with a free readiness check

Your sector, size and the deadlines you face.

“Q-Sec helped us move from patching issues to running a proper security programme. They tightened our data protection, built a compliance path for DORA and GDPR, and trained our team to think like security professionals.”
Oleksandr PankovOleksandr PankovCEO, Miloan Polska
Teams we work with
MiloanColobridgeFinXFlypayYuria-PharmCashpointFinmeAmigo
Get a free NIS2 readiness check

We reply within 1 business day.

Pixel icons by Streamline, CC BY 4.0. This page summarises Directive (EU) 2022/2555 and is not legal advice.