Compliance
NIS 2 Directive Compliance Services
Scope determination, Article 21 gap closure and a 24 hour incident notification workflow rehearsed before you ever need it.
NIS 2 made management personally accountable and shortened incident reporting to 24 hours. We determine whether you are in scope, close the Article 21 gaps, and rehearse the reporting workflow before you need it.
What the engagement covers
- Essential vs. important entity scope determination per member state
- Article 21 cybersecurity risk-management measure gap assessment
- 24/72-hour incident notification workflow and playbooks
- Supply chain security and vendor due-diligence programme
- Management body training and accountability documentation
How we run it
- Scope and map. We work out what is genuinely in scope, then map every framework you need onto one control set so nothing gets assessed twice.
- Close the gaps. Our consultants write the policies, configure the controls and collect the evidence with your team rather than handing you a findings list.
- Run the period. Controls have to operate over time. We monitor them through the observation window and fix drift before it becomes a finding.
- Issue and renew. We perform the audit and issue the report, then keep you ready so the next cycle costs a fraction of the first.
Why NexaVault for NIS 2
Our consultants hold the accreditations that matter for this framework, and we staff engagements ahead of time so you are not waiting on availability. Every engagement includes hands-on remediation support. We do not hand you a gap list and walk away.
- Fixed-fee proposals with no scope-creep billing
- Named senior consultant leading the engagement end to end
- Remediation support included, not sold separately
- Evidence reused across every other framework in your scope
Frequently asked questions
Start with whatever is blocking revenue. If deals stall on a security questionnaire from a North American buyer, that is usually SOC 2. European and APAC procurement more often asks for ISO 27001. We will tell you on the scoping call, and we will say so if you do not need one yet.
For SOC 2 Type 1 or ISO 27001, most teams are audit ready in eight to twelve weeks, then a Type 2 needs an observation window on top. The variable is not us, it is how much control work you already have in place.
No, and that is the point. We hold the CPA licence, the PCI QSA accreditation and the HITRUST authorisation, so the team that closed your gaps can also issue the report.
Far less than the first one. Because your controls are already mapped across frameworks, most of the evidence is reusable and the second certification is largely a scoping and gap exercise.
Every audit is preceded by a gap assessment and hands on remediation, so a surprise failure is rare. If a finding does appear, closing it is part of the engagement rather than a new invoice.
Ready to start your NIS 2 engagement?
Get expert advice on scope, timeline and cost from the NexaVault team.
Talk to an expert