You are not certain whether NIS-2 applies to you, what it means concretely, or where to start. In 30 minutes we give you an indicative classification, name the five most relevant gaps from the NIS-2 minimum measures, and recommend a clear next step. The legally binding assessment remains a matter for specialised counsel.
Or first run a 5-minute self-assessment: Start the NIS-2 maturity check
We work along the statutory NIS-2 criteria (sector, size, thresholds) and the ten minimum measures from §30 of the German NIS-2 implementation act. No slides, no tool demo, no sales pitch.
You tell us about your industry, size, sites, prior experience with ISO 27001 or similar standards, and which concrete NIS-2 question is on the table.
We check sector match (Annexes II and III of the NIS-2 implementation act), the size and revenue thresholds, and place you indicatively as likely essential, important or not affected. With reasoning. The legally binding assessment remains a matter for counsel.
We walk through the ten NIS-2 minimum measures (risk management, incident handling, business continuity, supply chain, access controls, cryptography, personnel, awareness, vulnerability management, effectiveness evaluation) and name the five most relevant open items for your organisation.
We name the suitable next step: NIS-2 gap assessment, vCISO bundle for organisations without an in-house CISO function, or platform onboarding project for organisations with an in-house CISO. Plus a cost estimate as a range, depending on size and number of sites.
You receive the substance of the call in writing, one page, in a form you can use further with management, IT leadership or your legal counsel.
Sector match, size and threshold indicator, indicative classification likelihood (likely essential, important or not affected), with reasoning and a note that the legally binding assessment remains a matter for counsel.
The five most relevant open items from the ten minimum measures per §30 of the NIS-2 implementation act, with a brief reasoning per item.
Which next step makes economic sense: NIS-2 gap assessment, vCISO bundle or platform onboarding project. If none of the three fits, we say so.
Rough range in euros and weeks, depending on company size, number of sites and internal availability. Not a fixed-price quote, but a planning figure.
We deliver an expert assessment based on the statutory NIS-2 criteria. The legally binding evaluation of your status under NIS-2 is a matter for a law firm with an IT-security-law focus. In our experience, the legal advice becomes more targeted and cheaper if you bring our pre-work to the conversation.
Which path follows depends on your situation, decided in the call. We do not reflexively recommend the most expensive route.
Structured baseline against the ten minimum measures with maturity score, gap report and a prioritised measure roadmap. Useful when the gap list needs to be concrete before investment decisions. Fixed price from 4,500 euros.
The Cybervize platform plus a virtual CISO who permanently fills the security function. Useful when no in-house CISO function exists and the NIS-2 implementation needs ongoing stewardship. From 3,600 euros per month.
Licence of the Cybervize platform plus 6 to 12 months of implementation support, handed over to your internal team. Useful when you have an in-house CISO and need the tool.
The risk check works with one person on the line but is markedly more productive with two or three roles at the table. You can invite colleagues after booking.
Decides on investments, carries legal responsibility for NIS-2 obligations and needs a clear statement on the next step.
Knows the actual IT architecture, supplier relationships and prior work. Without that view the gap assessment stays superficial.
If present. These roles know whether ISO 27001, TISAX or other standards are already running and where duplicate work can be avoided.
Memberships, programmes and partnerships
You book a slot, we prepare for your industry. Management and IT leadership should ideally both attend. After the call we send you the one-page summary by email.
Book the risk check