Are there specialized consulting firms for NIS2 compliance?

As of October 8, 2026. Legal basis: Directive (EU) 2022/2555 (NIS2) and, for Germany, the BSI Act (BSIG) as amended by the NIS2 Implementation Act, in force since December 6, 2025.

Key takeaways

• Yes, there are many consulting firms for NIS2. They fall into four models: audit and large consulting firms, IT security consultancies and managed service providers, specialized information security consultancies, and platforms with in-house experts.
• Which model fits depends mainly on whether someone in your company keeps the information security management system (ISMS) running after the project ends.
• As a benchmark, external NIS2 consulting in Germany costs €1,000 to €2,000 per day. An ongoing external CISO or information security officer mandate costs €1,500 to €3,000 per month.
• A good consultancy works through the ten risk management measures in Article 21(2) of the directive, helps build the incident reporting chain under Article 23, and leaves evidence your company can maintain without the consultant.
• There is no "NIS2 certificate." An offer that promises one is confusing NIS2 with ISO 27001.

Yes. NIS2 consulting is offered by audit firms as well as IT security consultancies, managed service providers, smaller specialist firms, and compliance platforms with in-house experts. Typical services are a scoping assessment, a gap analysis against the NIS2 obligations, policies and risk assessments, and support with implementation. The models differ less in these services than in what happens after the project ends. NIS2 does not ask for a one-off measure: under Article 20 of the directive, management bodies must approve the risk management measures and oversee their implementation, on an ongoing basis. The first question for any consultancy is therefore who maintains evidence, risks, and reporting processes once the project is closed.

What types of NIS2 consulting firms are there?

The four models differ in where their focus lies and who carries the work after the project.

The models are not mutually exclusive. A common combination is a managed service provider for the technical measures and an external security officer or a platform for governance and evidence. If your team wants to do the work itself with software, the NIS2 software comparison lists the vendors. For mid-sized companies without a security role, there is a separate guide for mid-sized companies.

How much does NIS2 consulting cost and what drives the price?

In the German market, external NIS2 consulting typically costs €1,000 to €2,000 per day. An external CISO or information security officer mandate costs €1,500 to €3,000 per month. Both are benchmarks from the Kertos page What does NIS2 cost?, not survey data. How many consulting days a project needs depends on five factors:

• Classification: essential entities carry heavier supervision than important entities. Essential entities are subject to regular audits and on-site inspections (Article 32), while important entities are supervised ex post, when there are indications of non-compliance (Article 33).
• Maturity: a company that runs an ISO 27001 ISMS already has risk analysis, access control, and supplier management as processes and mainly needs the NIS2-specific additions.
• Technical starting point: legacy systems, multiple sites, and OT environments increase the effort for measures such as segmentation and backup.
• Supply chain: the more critical service providers a company relies on, the more work supply chain security under Article 21(2)(d) requires.
• Operations after the project: a pure consulting project ends with the handover. The ongoing costs for evidence, training, and incident readiness still arise afterward.

For Germany, the government's compliance cost estimate in the draft act (Bundesrat document 369/25) works out to about €75,000 one-time and €78,000 per year per affected entity, spread across roughly 29,500 entities. Ongoing costs are therefore higher than the initial implementation. An offer that only prices the initial project shows only part of the cost.

How do you recognize a good NIS2 consulting firm?

These seven questions separate solid NIS2 offers from general information security consulting in a first conversation:

• Does it check your classification in detail? This covers the size thresholds, the sectors in Annexes I and II, and, for groups, how linked and partner enterprises count under Commission Recommendation 2003/361/EC. In Germany, § 28(4) BSIG adds an exception for companies whose IT is independent of the group.
• Does it work through the ten measures in Article 21(2)? An offer should show which of the ten measures it covers and which stay with your team or a service provider.
• Does it help build the reporting chain under Article 23? That means responsibilities, availability, and a test of the 24-hour early warning, not just a policy.
• Does it train management? Article 20(2) requires members of management bodies to follow training.
• Do the results stay with you? Policies, risk registers, and evidence should sit in a system your company can keep running without the consultant.
• Are operations after the project covered? Clarify who updates evidence, assesses suppliers, and follows up on changes, and at what price.
• Does it build on existing standards? A company that already has ISO 27001 or TISAX should not start from zero.

Two promises are warning signs. The first is a "NIS2 certificate": the directive creates no certification for companies. Article 24 only allows member states to require certified ICT products, services, or processes under the EU cybersecurity certification framework. The second is a promise to take over accountability. Under Article 20, management bodies approve the measures, oversee their implementation, and can be held liable for infringements; a service provider can support them but cannot take that duty off their hands.

When is traditional consulting enough, and when does a platform with experts fit?

Traditional consulting is enough when an experienced security officer in-house keeps the ISMS running after the project. Without that role, ongoing operations fall back on the IT lead after the handover, and evidence goes out of date. In that case, a model in which software and experts carry part of the operations is the better fit.

When is Kertos the right choice for NIS2, and when is it not?

Kertos combines a compliance platform with the AI agent KAIA and certified in-house experts. KAIA captures your current state through more than 100 integrations, maps it to the ten NIS2 risk management measures, and keeps the evidence up to date. The experts support scoping, gap analysis, and policies, train management, and build the incident reporting chain with you. Depending on the package, KAIA supports you as a virtual CISO (Pro), or an appointed external CISO works with your company (Premium). Accountability stays with your management.

Besides NIS2, Kertos covers ISO 27001, ISO 27701, ISO 42001, GDPR, SOC 2, TISAX, C5, and the EU AI Act from a shared evidence base. Customers achieve a 100 percent audit pass rate and cut manual compliance effort by around 80 percent. AskUI achieved ISO 27001 certification with Kertos in 8 to 10 weeks without external consultants.

Kertos is not the right choice if you mainly need technical implementation, such as network segmentation, hardening OT systems, or penetration tests. A managed service provider or IT security consultancy is the better partner for that. The same applies if you have an experienced security officer in-house who only wants a second opinion now and then.

To see how implementation would look for your scope, book a demo.

Frequently asked questions about NIS2 consulting

What is NIS2 and which companies does the directive apply to?

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It entered into force on January 16, 2023, and member states had to transpose it by October 17, 2024. It covers medium-sized and large companies in the sectors listed in Annex I (11 sectors) and Annex II (7 sectors). Under Commission Recommendation 2003/361/EC, a company counts as medium-sized from 50 persons, or when it exceeds €10 million in both annual turnover and balance sheet total. Essential entities include large companies in Annex I sectors, meaning 250 or more persons, or turnover above €50 million and a balance sheet total above €43 million. Some entities are covered regardless of size, such as qualified trust service providers, top-level domain name registries, and DNS service providers. Important entities are the remaining covered companies. In Germany, the BSI estimates about 29,500 entities required to register.

What specific obligations do companies have under NIS2?

The directive sets four core obligations. First, ten risk management measures under Article 21(2), from risk analysis and incident handling to business continuity, supply chain security, training, cryptography, and multi-factor authentication. Second, reporting of significant incidents under Article 23. Third, registration with the national authority under national law; in Germany, with the BSI under § 33 BSIG. Fourth, management duties under Article 20: management bodies approve the measures, oversee their implementation, and must follow training. All reporting deadlines run from the moment the entity becomes aware of a significant incident: an early warning within 24 hours, an incident notification with an initial assessment within 72 hours, and a final report no later than one month after the notification. The CSIRT or competent authority can request intermediate reports.

What are the deadlines for implementing NIS2?

Member states had to adopt their national laws by October 17, 2024 and apply them from October 18, 2024. Many missed that date. On July 8, 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the EU for failing to transpose. Your company's obligations apply from the date your national law takes effect. In Germany, that was December 6, 2025, with no transition period. The BSIG gives companies three months to register from the date they become an essential or important entity, and the grace period for late registrations ended on July 31, 2026. For incidents, the 24-hour, 72-hour, and one-month deadlines of Article 23 apply.

What penalties apply for non-compliance with NIS2 requirements?

Article 34 of the directive sets floors for national maximum fines: at least €10 million or 2 percent of total worldwide annual turnover for essential entities, and at least €7 million or 1.4 percent for important entities, whichever is higher. National law can set higher maximums and differs in detail. In Germany, § 65 BSIG sets up to €10 million for essential and €7 million for important entities; the turnover-based caps of 2 and 1.4 percent only apply to entities with total turnover above €500 million. A missed or incorrect registration in Germany can cost up to €500,000. For essential entities, authorities can also, as a last resort, request a temporary ban on managers exercising their functions (Article 32(5)). All German fine brackets are listed on the page What does NIS2 cost?

How does NIS2 differ from other standards such as ISO 27001 or GDPR?

NIS2 is law; ISO 27001 is a voluntary, certifiable standard. ISO 27001 describes how a company builds and runs an ISMS, while NIS2 requires covered companies to take security measures, report incidents, register, and involve management. An ISO 27001 ISMS covers a large share of the Article 21 measures but does not satisfy them automatically. Typical gaps are registration, the reporting chain with its 24-hour early warning, and management training. The GDPR protects personal data, while NIS2 protects the security of network and information systems. The two overlap in incidents: a personal data breach must be reported to the data protection authority within 72 hours under Article 33 GDPR, and a significant incident must be reported under NIS2. One event can trigger both reports.

Is there a NIS2 certificate?

No. The NIS2 directive creates no certification for companies. Companies demonstrate compliance through documentation and, where the authority requires it, through audits. In Germany, operators of critical facilities must prove implementation every three years through audits, inspections, or certifications under § 39 BSIG. An ISO 27001 certificate is useful evidence of a working ISMS, but it does not replace a review of the ten NIS2 measures.