What does NIS2 implementation cost?
Updated: 2026-11
The cost of NIS2 implementation is driven mainly by the starting point: companies that already run an information security management system add registration, reporting and management duties. Those starting from scratch need risk management, measures, documentation and training. Size, locations and the supply chain come on top.
NIS2 does not require specific products but appropriate risk management with minimum measures. What that costs depends less on the law than on how far a company already is.
Besides consulting, costs often arise for technical measures such as multi-factor authentication, backups or logging, and for internal time.
What drives the cost
Starting point
An existing ISO 27001 ISMS covers a large part; without a foundation the effort is significantly higher.
Size and locations
More locations, entities and systems mean more risk analysis, measures and coordination.
Supply chain
The security of key providers must be assessed and contractually regulated; many suppliers raise the effort.
Reporting process
A working procedure for 24-hour, 72-hour and one-month reports needs roles, templates and an exercise.
Technical measures
Gaps in access, backup, logging or encryption cause costs for tools and implementation.
Ongoing operation
Reviews, management training and evidence are recurring, not one-off.
How we price
- 01
Classification and registration
Fixed scope for applicability and registration documents as the first step.
- 02
Implementation project
Close gaps according to a prioritised plan, with fixed scope per package.
- 03
Ongoing support
Annual review, exercise and management training as a recurring service.
We deliberately publish no online prices: every case differs. After a short first conversation you receive a binding fixed price or clear frame.
Parent service: Cyber readiness & IT security
Matching offers
NIS2 implementation in Germany and Austria
In Germany the NIS2 implementation act has applied since 6 December 2025, in Austria the NISG 2026 since 1 October 2026. We establish applicability, prepare registration and implement the core duties: risk management, reporting within 24 and 72 hours, supply chain security and approval by management.
Cyber readiness check
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
Compliance assessment for companies
The compliance assessment establishes in one pass which regulations apply to your company, from data protection to the AI Act, NIS2 and the Swiss ISA, the Data Act, accessibility and e-invoicing. You receive a reason for each regulation, a risk and deadline rating for each gap and, at the end, an action plan.
FAQ
Does NIS2 require a certified ISMS?
No. Certification is not mandatory, but a structured management system makes implementation and evidence much easier.
What does doing nothing cost?
Both laws provide for fines, and management can be liable. Add the risk of an incident without preparation.
Where to start on a small budget?
With classification, registration, the reporting process and the most effective basics such as multi-factor authentication and tested backups.