NIS2 readiness assessment in 15 minutes

NIS2 compliance means meeting the obligations of Directive (EU) 2022/2555 as implemented in your member state: risk-management measures in the 10 areas of Article 21, incident reporting (early warning within 24 hours, notification within 72 hours, final report within one month of the incident notification), registration with the competent authority, and oversight by the management body. National authorities enforce it, not the EU directly.

Medium and large organisations in the 18 sectors of Annexes I and II: 50 or more employees, or fewer with both turnover and balance sheet above €10 million. Some providers are in scope regardless of size, such as public administration bodies and DNS service providers. Smaller suppliers are often pulled in through the supply-chain requirements of in-scope customers.

No. NIS2 is an EU directive and does not apply in the UK, which is reforming its own NIS Regulations 2018. A UK company is still affected through subsidiaries in the EU, and cloud, DNS, managed service and some other digital providers that offer services in the EU must designate a representative in a member state (Article 26).

Not everywhere. Member states had to transpose NIS2 by 17 October 2024, but on 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to do so in full. Ireland’s National Cyber Security Bill has not yet been enacted. The Netherlands has since applied its Cyberbeveiligingswet from 15 August 2026.

Not on its own. ISO 27001 is a voluntary, certifiable standard; NIS2 is a legal obligation. An ISO 27001 management system covers much of Article 21, but not registration with your authority, the 24- and 72-hour incident reports or the training duty of the management body. Treat it as strong evidence and close the remaining gaps with a NIS2-specific assessment.

Yes, we take security very seriously. All data is stored encrypted, we use multi-tenant isolation, and comply with GDPR. Your data is never shared with third parties and you can delete your account and data at any time.

Yes, you can cancel your subscription at any time. There is no notice period. After cancellation you keep access to your account until the end of the paid period: until the end of the current month on a monthly subscription, and until the end of the current annual term on an annual subscription. Amounts already paid are not refunded.