Which NIS2 consulting firm is right for your company?

As of October 14, 2026. Legal basis: Directive (EU) 2022/2555 (NIS2) and, for Germany, the BSI Act (BSIG) as amended by the NIS2 Implementation Act, in force since December 6, 2025. Provider details come from each provider's own website, checked on October 14, 2026.

Before you hire a NIS2 compliance consultant, decide whether you need a project or a permanent role. A one-off project, such as scoping and ISMS setup, comes from specialist information security consultancies, the consulting arms of testing organizations, or large consulting firms; if nobody in your company will run the ISMS afterward, you also need an external information security officer or CISO mandate. In Germany, the average consulting day rate in 2025 was €1,300, according to the consultants' association BDU.

Key takeaways

• The right NIS2 consulting firm depends on what your company is missing: a one-off project, such as a gap analysis and ISMS setup, or a permanent role, such as an information security officer or CISO. Mid-sized companies usually lack both.
• NIS2 consulting comes from four models: specialist information security consultancies, consulting arms of testing and certification organizations, large consulting firms, and platforms with in-house experts and an external CISO mandate.
• In the Kertos NIS2 Readiness Study 2026, 84% of the German companies surveyed, with 50 to 1,000 employees, had neither an internal nor an external CISO. For these companies, consulting has to include a plan for who runs the ISMS after the project.
• In Germany, the average consulting day rate in 2025 was €1,300, according to the German consultants' association BDU. The survey does not report a separate figure for information security.
• There is no NIS2 certificate. Under Article 20 of the directive, management bodies approve the measures and oversee their implementation, whoever does the work.

The right NIS2 consulting firm depends on two questions: does your company need a project or a permanent role, and are production systems in scope? A defined project with scoping, gap analysis, and ISMS setup is what specialist information security consultancies (such as Opexa Advisory or carmasec), consulting arms of testing organizations (such as TÜV Rheinland Consulting or DEKRA), and large consulting firms (such as PwC, KPMG, or Deloitte) deliver. If nobody in the company will run the ISMS afterward, you also need an external information security officer or CISO mandate. Several specialist consultancies offer one, as do platforms with in-house experts such as TrustSpace, Secfix, or Kertos. Technical security for production networks is work for OT specialists in every model.

The NIS2 threshold sits in the mid-market: a company in an Annex I or Annex II sector is in scope from 50 employees (Article 2 and Article 3 of the directive). For them, the question of the permanent role usually decides the choice, which is why it comes straight after the models on this page.

What types of NIS2 consulting are there?

The four models differ in what they deliver and in who carries the work after the project.

One rule matters when you work with testing organizations. Under ISO/IEC 17021-1, clause 5.2, a certification body may not offer management system consultancy itself. Where a body related to it has consulted on your management system, the standard names as a recognized safeguard that the certification body does not certify that system until at least two years after the consultancy ends. If you plan ISO 27001 certification after your NIS2 project, settle who consults and who certifies before you sign.

The models can be combined. If your team wants to do the work itself with software, the NIS2 software comparison lists the vendors.

Which NIS2 consulting fits a mid-sized company?

Mid-sized companies usually lack the permanent role as well as the project know-how. For the NIS2 Readiness Study 2026, Kertos surveyed 51 companies based in Germany with 50 to 1,000 employees, all in sectors listed in Annex I of the NIS2 directive (August 3 to September 4, 2026). 84% had neither an internal nor an external CISO. In 63%, the IT lead was responsible for NIS2, and in 41% the IT lead was the only role named.

That gives you one test for every offer: who runs the ISMS after the handover? A project that ends by handing over to a security officer the company does not have leaves policies with no owner.

Example: a machine builder with 150 employees falls under Annex II of the directive (manufacturing, manufacture of machinery and equipment, NACE C28). From 50 employees, it is a medium-sized enterprise and therefore an important entity. In Germany, that is a wichtige Einrichtung under § 28(2) BSIG. Suppose the IT lead carries NIS2 alongside day-to-day operations, no security officer is appointed, and production machines are connected to the company network. The company then needs a project for the gap analysis and ISMS, a person or mandate to run it afterward, and an OT specialist for the production networks.

Which software fits which starting point is covered in NIS2 software for mid-sized companies.

Which providers offer NIS2 consulting in Germany?

The providers below are examples of the four models, all active in the German market. The descriptions reflect what each provider states about NIS2 on its own website (checked October 14, 2026). The list is not a recommendation for your case and is not complete. DataGuard, Proliance, Secfix, the large consulting firms, and the testing organizations also serve clients outside Germany.

What should NIS2 consulting deliver?

Complete NIS2 consulting covers six phases. For each phase, expect the following:

1. Scoping: classification by sector, size, and group structure under Article 3 and Annexes I and II. In Germany, the BSI's NIS2 scoping check is a good start; the BSI states that its result is not legally binding.
2. Gap analysis: a review against the ten measures in Article 21(2), with a clear split between what the consultancy covers and what stays with your IT team.
3. ISMS setup: policies, risk analysis, and evidence in a system your company can keep running without the consultant.
4. Incident reporting under Article 23: responsibilities, availability, and a tested process for the 24-hour early warning.
5. Management duties under Article 20: training for members of the management body and a process for overseeing implementation.
6. Operations and an external CISO: a named person who keeps evidence, risks, and suppliers up to date. Models and monthly costs are compared in the vCISO provider comparison.

Five criteria separate offers in a first conversation:

• What stays in the company after the project? Documents on a shared drive, or a maintained system with owners.
• What OT expertise does the provider have? Ask for references from production environments if control systems are in scope.
• Fixed price or day rate? Ask for the days per phase.
• Does the provider know companies of your size? Ask for references from mid-sized companies and from your industry.
• Are software and evidence management included? Or are they a separate project?

How much does NIS2 consulting cost?

According to "Honorare im Consulting 2025" by the German consultants' association BDU (December 2025), the average billed day rate in Germany in 2025 was €1,300, and €1,600 at partner and managing director level. The survey reports IT consulting but no separate figure for information security. How many days a NIS2 project takes depends on classification, maturity, OT environment, and supply chain. If a mid-sized company has no security officer, the ongoing cost of that role comes on top of the project days.

For Germany, the government's compliance cost estimate in the draft act (Bundesrat document 369/25) works out to about €75,000 one-time and €78,000 per year per affected entity. Ongoing costs are therefore higher than the initial project. The breakdown is on the page What does NIS2 cost?

When is Kertos the right choice, and when is it not?

Kertos combines a compliance platform with the AI agent KAIA and certified in-house experts. KAIA maps your current state to the ten NIS2 risk management measures and keeps the evidence up to date. The experts support scoping, the initial assessment, and policies, train management, and build the incident reporting chain with you.

• Model: platform plus certified in-house experts.
• External CISO / information security officer and DPO: as a mandate, in the same system.
• Frameworks: NIS2, ISO 27001, TISAX, GDPR, ISO 27701, ISO 42001, SOC 2, C5, and the EU AI Act from one evidence base.
• Headquarters and hosting: Munich, developed and hosted in Europe.
• Results: 100% audit pass rate; around 80% less manual compliance effort; AskUI achieved ISO 27001 certification in 8 to 10 weeks without external consultants.

Kertos is not the right choice in these cases:

• A group wants a project team from a large audit and consulting firm for international structures.
• The work is technical OT security for production. Technical OT security, such as segmenting production networks, hardening controllers, or measures under IEC 62443, is work for specialist partners.
• You want a one-off consulting project without software.
• You need an on-premises deployment, or BSI IT-Grundschutz is your leading standard.

To see how implementation would look for your scope, book a demo.

Frequently asked questions about NIS2 consulting

Do we need NIS2 consulting, or is software enough?

Software is enough when an experienced person in-house runs the ISMS and makes the expert judgments, for example whether a measure is appropriate to the risk. Without that person, you need consulting or an external mandate in addition to the software. The NIS2 software comparison shows which vendors include experts.

Can an external CISO take over NIS2 accountability?

An external CISO can take over the work: steering measures, maintaining evidence, supporting incident response, and reporting to management. Accountability stays with management. Under Article 20 of the directive, management bodies approve the risk management measures, oversee their implementation, and must follow training. In Germany, § 38(1) BSIG requires management to implement the measures and oversee their implementation.

Can certification bodies also consult?

Not on the same management system. Under ISO/IEC 17021-1, clause 5.2, a certification body may not offer management system consultancy itself. Where a related body has consulted, the standard names as a recognized safeguard a period of at least two years after the consultancy ends before the certification body certifies that management system.