NIS2 Consulting for Companies
Since December 2025, NIS2 has been German law (NIS2UmsuCG). Around 30,000 companies must protect themselves against data breaches, ransomware, phishing attacks, insider threats and DDoS attacks — with fines of up to EUR 10 million and personal liability for managing directors under Section 38 BSIG. We guide you from the applicability assessment through penetration testing to the implementation of the NIS2 requirements.
Why NIS2 Consulting?
Know your obligations, implement the measures and document the implementation verifiably
Applicability Assessment
Clarifying whether NIS2 applies to your company: from 50 employees or EUR 10 million turnover across 18 sectors. The NIS2 Implementation Act clearly defines the thresholds — we verify your exact classification as an 'essential' or 'important' entity in accordance with Section 28 BSIG.
Fine Risk up to EUR 10 Million
The German NIS2 Implementation Act provides for fines of up to EUR 10 million or 2% of global annual turnover; 'important entities' face up to EUR 7 million or 1.4% of turnover. We help you implement the requirements and document them verifiably. The deadline has already passed — act now.
Document Management Duties Verifiably
NIS2 provides for personal liability of the management (Section 38 BSIG). Managing directors must oversee the implementation of risk management measures and take part in cybersecurity training. We document the measures you have taken in a traceable way.
Penetration Testing
A NIS2 obligation under Section 30 BSIG: regular security tests for web applications, networks, APIs and mobile applications by experienced specialists. We identify vulnerabilities before attackers do — with a detailed report and action plan.
Set Up the 24h Reporting Obligation
Section 32 BSIG requires: an initial report to the BSI within 24 hours, a detailed report within 72 hours and a final report within one month. We establish your complete incident response process with clear roles, communication channels and templates for the BSI report.
Systematic Risk Management
Systematic risk assessment and action plan under Section 30 BSIG — the foundation of your NIS2 compliance. We identify, evaluate and prioritise your IT risks and create a documented treatment plan with concrete measures and timelines.
ISMS Setup (ISO 27001)
An Information Security Management System (ISMS) in accordance with ISO 27001 is the ideal foundation for NIS2 compliance. We support you in building or extending your ISMS — from policy development through risk assessment to certification preparation.
BSI Registration
Affected companies must register with the BSI and designate a point of contact. We handle the registration, document your reporting channels and keep track of the deadlines for you.
Cyber Hygiene & Training
NIS2 requires verifiable cybersecurity training for managing directors and employees (Section 38 BSIG). We offer phishing simulations, security awareness training and management workshops — documented and prepared for audits.
NIS2 Compliance at a Glance
Compliance Documentation
Risk Assessment & Audit
Full Control over Your NIS2 Compliance
From the applicability assessment through gap analysis to complete BSI registration — our dashboard gives you an overview. NIS2 provides for fines of up to EUR 10 million and personal liability of the management under Section 38 BSIG — reason enough to document implementation early and verifiably.
Our NIS2 Services
From gap analysis to the implementation of the measures under Section 30 BSIG
NIS2 Gap Analysis
A current-vs-target comparison of your IT security against the NIS2 requirements (Section 30 BSIG). You receive a detailed action plan with prioritisation, timeline and cost estimate for every identified gap.
Applicability Analysis under the NIS2 Implementation Act
A detailed review of whether and which NIS2 obligations apply to your company — including sector assignment under Annexes I/II of the EU Directive and classification as an 'essential' or 'important' entity (Section 28 BSIG).
Penetration Testing under Section 30 BSIG
Web, network and API pentests — legally required under NIS2 for regular vulnerability analysis. We use OWASP Top 10, PTES and OSSTMM as frameworks. Detailed report with CVSS scoring.
Risk Assessment under Section 30 BSIG
Systematic risk management with documented assessment and treatment plan. Based on BSI baseline protection (IT-Grundschutz) or ISO 27005 — tailored to your company size and industry requirements.
Incident Response Plan (Section 32 BSIG)
A complete reporting process: 24h initial report, 72h detailed report and final report to the BSI. Including role assignment, escalation paths, communication templates and regular incident response exercises.
Supply Chain Security (Section 30 (2) No. 4)
Supply chain security for NIS2 compliance: assessment and protection of your suppliers and service providers. Contractual safeguards, regular security reviews and risk assessment across the entire value chain.
Security Awareness (Section 38 BSIG)
Management and employee training — NIS2 requires verifiable cybersecurity training. Including phishing simulations, social engineering tests and individual training plans.
Compliance Documentation & Audit
ISMS setup, structured evidence documentation and audit preparation for the BSI review. Policies, guidelines and records filed in an orderly and traceable way — including for external auditors.
Business Continuity Management
Section 30 BSIG requires measures to maintain operations. We create BCM plans, define recovery times (RTO/RPO), implement backup strategies and carry out regular recovery tests.
Cryptography & Encryption
NIS2 requires the use of cryptography (Section 30 (2) No. 7). We review and implement encryption concepts for data at rest, in transit and during processing. Including a key management strategy.
The Most Important NIS2 Provisions
What the NIS2 Implementation Act specifically requires from your company
Section 28 BSIG — Classification of Entities
The NIS2 Implementation Act distinguishes between 'essential entities' (essential sectors, from 250 employees or EUR 50 million) and 'important entities' (important sectors, from 50 employees or EUR 10 million). The classification determines the scope of obligations and the level of possible fines.
Section 30 BSIG — Risk Management Measures
The core of the NIS2 obligations: risk analysis, security measures, incident handling, business continuity, supply chain security, vulnerability management, cyber hygiene, cryptography, access control and multi-factor authentication. All measures must be proportionate.
Section 32 BSIG — Reporting Obligations
In the event of significant security incidents: 24 hours for the initial report, 72 hours for the detailed report and a maximum of one month for the final report. Reporting is submitted to the BSI via an electronic reporting system. Late reports can themselves trigger fines.
Section 38 BSIG — Management Duties
Managing directors must approve the implementation of the risk management measures, oversee their implementation and take part in cybersecurity training. If they breach these duties, they are personally liable. This liability cannot be removed through delegation.
Are You Affected by NIS2?
Check for free in 4 steps whether your company falls under the NIS2 Directive.
Start the Free NIS2 CheckRelated Services
Matching services that complement your project
Frequently asked questions
The questions we are asked most often before a project – with answers on process, costs and data protection.
What is NIS2 consulting and what does it actually deliver?
NIS2 consulting guides your company in meeting the requirements of the EU NIS2 Directive and its German implementation in a structured way. It first clarifies whether and how your business is affected, then measures the gap between your current and target state (gap analysis) and derives prioritised measures for risk management, reporting channels and governance. As NovaCon from Bad Camberg in the Taunus, we translate the legal requirements into a practical roadmap that fits the size and IT landscape of a mid-sized business.
Is my company even affected by NIS2 at all?
Being affected depends on three factors: your sector, your company size and your role in supply chains. As a rule, medium and large entities from around 50 employees or 10 million euros in annual turnover in certain sectors fall under it, and smaller businesses can be indirectly obligated as suppliers to affected entities. Because the classification is tricky in detail, we run a structured affectedness assessment at the start rather than making a blanket statement.
How does a NIS2 consulting project at NovaCon work?
We work in clear phases: first clarify affectedness and classification, then run a gap analysis against the required minimum measures, followed by a prioritised action plan and the setup of risk management, reporting and governance processes. After that we support the implementation and the proof of effectiveness. You receive traceable results and documents in every phase, so you can gauge progress and remaining effort at any time.
What does NIS2 consulting cost?
The cost depends heavily on scope: from a compact affectedness assessment and gap analysis to full implementation support including processes and documentation. The key drivers are your company size, the complexity of your IT and your existing maturity level in information security. After a free initial consultation and the affectedness assessment we give you a concrete, transparent range, rather than working with flat rates that don't fit your case.
How long does implementing NIS2 take?
An affectedness assessment and initial gap analysis can often be completed within a few weeks. Full implementation of the required measures and processes typically stretches over several months depending on your starting point, and in larger or poorly prepared environments even over nine to twelve months. We prioritise the critical items first so you become capable of acting quickly instead of waiting for the entire project to finish.
What specific obligations does NIS2 bring?
Affected companies must introduce appropriate risk management with technical and organisational minimum measures, for example on incident handling, business continuity, supply chain security, access control and encryption. On top of that come reporting duties for significant security incidents within tight deadlines, plus a special responsibility of management, which must approve and oversee the measures. We translate these obligations into a practical checklist and concrete processes for your business.
What happens if I ignore NIS2 or act too late?
In Germany the supervisory authority is the BSI, which can audit and enforce compliance; violations can lead to substantial fines and personal liability for management. Regardless of sanctions, being unprepared is a real risk for business interruption and reputational damage in an emergency. Rather than waiting, a structured start with an affectedness assessment makes sense, so you know your actual need for action and can prioritise deliberately.
What is the difference between NIS2 and the GDPR?
The GDPR protects personal data and governs how you may handle that data. NIS2, by contrast, targets the overall cybersecurity and resilience of critical and important entities, meaning the availability and integrity of your systems, not just data protection. In practice the two overlap on technical measures and reporting processes but pursue different goals. We align NIS2 measures so they sensibly complement existing data protection structures rather than contradicting them.
Do I need an ISO 27001 certification for NIS2?
An ISO 27001 certification is not strictly mandatory for NIS2, but it already covers many of the required minimum measures and makes it easier to demonstrate a functioning information security management system. If you already work to ISO 27001, we use it as a foundation and close the remaining NIS2 gaps specifically. If not, we build the required structures pragmatically, without pushing you into a full certification you don't need.
For whom is external NIS2 consulting especially worthwhile?
External support is especially worthwhile for mid-sized companies that don't have their own large IT security department and don't want to tie up scarce internal capacity for months. Businesses that suddenly have to meet their clients' security requirements as suppliers also benefit from a clear classification. As a regional partner from the Rhine-Main region, we combine short distances and personal contacts with a structured approach, instead of leaving you alone with an anonymous standard process.
What are the required minimum measures in risk management?
NIS2 requires a catalogue of technical and organisational measures, including concepts for risk analysis, handling security incidents, maintaining operations and backup management, supply chain security, access control, and encryption and cryptography concepts. In addition come cyber hygiene training and verification of effectiveness. In the gap analysis we assess which of these points you already meet and close the gaps with measures that fit your business and budget.
How do I start and what is the first step with NovaCon?
The first step is a free initial consultation in which we roughly classify your industry, size and IT situation. This is followed by a structured affectedness assessment that clarifies whether and to what extent NIS2 applies to you, along with an initial gap analysis. From these results we derive a prioritised roadmap that you can either implement with us or continue internally. That way you only invest in implementation once your actual need for action is clearly on the table.
Ready for the next step?
Let's discuss in a free initial consultation how we can move your business forward.