The NIS2 Directive will come into effect on October 1, 2026. From this date, affected entities will be subject to requirements including risk management, supply chain security, and the reporting of significant security incidents. Separate deadlines apply for registration and self-declaration.

The NIS2 Directive does not mandate ISO 27001 certification across the board. However, an effective ISMS can serve as an excellent foundation for implementing requirements in a structured manner and maintaining the necessary documentation. We will work with you to determine whether certification makes sense for your customers, industry, or upcoming tenders.

While certification provides a significant advantage, it does not automatically replace all steps specific to NISG-2026. Key areas to review include scope, registration, self-declaration, reporting processes, management training, and supply chain requirements. A gap analysis will determine which additions are actually necessary.

Whether or not you are affected depends on more than just your number of employees or annual turnover. Specific legal criteria and your role as a supplier or service provider can also be relevant. If you are unsure, we can clarify your situation during our NISG check.

This depends on the scope, current maturity level, company size, existing documentation, and available resources. Rather than promising a blanket timeframe, we create a prioritized roadmap with realistic work packages following our initial analysis.

Yes, there is often valuable overlap in risk assessment, responsibilities, training, documentation, and incident management. However, NIS2 and the GDPR pursue different protection objectives. Therefore, existing processes should be carefully reviewed rather than assumed to be identical without verification.