Everything You Need to Know About NIS2

The NIS2 Directive primarily applies to medium and large enterprises operating in so-called essential sectors – such as energy, healthcare, transport, telecommunications, water supply, digital infrastructure, outsourced ICT services, digital service providers, postal services, waste management, space sector, food, manufacturing, and chemicals, as well as research.

The directive also covers certain critical actors, such as electronic communications providers, trust service providers, DNS service providers, top-level domain registries, and domain name registrars.

The final determination depends on the critical nature of the service and the number of employees.

From 17 October 2024, compliance is mandatory based on national legislation in the Member States. Now is the time to prepare, as the closer the deadline, the less room there will be for maneuver.

This depends on the current information security maturity of the organization. The minimum duration is usually 2 months, but 6–12 months may be needed for more complex systems, especially if internal regulations are lacking. Our expert support remains available after the audit for long-term sustainability.

During a GAP analysis, we compare current operations and regulations with NIS2 requirements. Based on the identified gaps, we propose the necessary improvements – this forms the basis of the preparation plan.

It is not recommended. The purpose of the audit is to check compliance – not to provide consultancy. Without preparation, the organization is likely to have many deficiencies, which can only be corrected after a follow-up audit. Find out more about why preparation is absolutely essential for a successful NIS2 audit.

The audit fee depends on several factors: the size of the organization, sector, number of affected systems, etc. We provide a separate information sheet on the exact details – read our article on NIS2 audit fees or request a quote from our experts.

1. GAP analysis: We assess the current state and the expected requirements.
2. NIS2 preparation: We implement the necessary measures, policies, documentation, and training.
3. NIS2 audit: We assist during the audit, which is carried out by our SZTFH-accredited audit partner.

• Get to know the NIS2 requirements in detail.
• Check if your company is among the affected organizations.
• Contact us – we help with the GAP analysis and preparation plan.
• Request a tailored quote for a service package suited to your organization.

Régens has decades of experience in cybersecurity, IT consulting, and EU compliance. Our expert team is up-to-date with NIS2 requirements and applies a structured, practical approach that supports real business operations as well as compliance. Our references, certifications, and certified partners are your guarantee.

1. Self-identification: We help determine if you are affected by the directive.
2. GAP and risk analysis: We identify gaps and risk sources.
3. Implementation of protective measures: We help with practical implementation.
4. Audit support: We assist with the official audit and provide follow-up support.

• The audit is not a one-off check – maintaining compliance is an ongoing task.
• A renewal audit is required every two years under the NIS2 directive.
• If deficiencies are found during the first audit, an action plan must be drawn up and corrective steps taken.
• Security incidents must be reported to the authority within the specified deadline.
• The appropriate level of cybersecurity must be maintained continuously, supported by documentation and internal controls.
• The Information Security Officer (ISO) plays a key role in internal management, incident handling, and ongoing compliance.

👉 Régens’ external CISO service can take over this complex role – so you can be sure that compliance with the NIS2 directive is maintained efficiently and up-to-date by a team of experts.