NIS2 · Directive (EU) 2022/2555
Hard2bit's NIS2 consulting takes your organisation from "does it apply to us?" to compliance you can demonstrate: applicability assessment, Article 21 gap analysis, a roadmap approved by management, control implementation, a 24/72-hour incident reporting procedure and an evidence dashboard for customers, auditors and the authority.
No obligation · Proposal tailored to your classification and starting point.
Applicability
NIS2 is Directive (EU) 2022/2555 on the security of network and information systems. It requires essential and important entities across 18 sectors to manage cyber risk, report incidents and answer for it before their management body. And it reaches, by contract, the suppliers of those entities.
Sectors, thresholds and what each measure requires are explained in detail in our practical guide to NIS2 compliance in Spain (in Spanish). Here we focus on how we help you comply.
The regulatory assessment tells you which frameworks apply to you —NIS2, ENS, DORA, ISO 27001— by sector, size and customers. If the answer is NIS2, the next step is a defensible applicability report.
Run the assessmentService scope
NIS2 is not met with a folder of policies. It is met with controls that work, owners who answer for them and evidence you can show. The service covers the eight areas the directive demands.
We determine whether your organisation is an essential entity, an important entity or an affected supplier, with documented reasoning you can defend before customers and the authority.
We check the ten risk-management measures against what actually exists: controls, processes, owners and evidence.
Approval and oversight of the measures by the management body (Article 20), training for executives and indicator-based reporting.
Classification, escalation and reporting process at 24 hours, 72 hours and one month (Article 23), with playbooks and evidence.
Assessment of critical suppliers, contractual clauses and continuous monitoring of third-party risk.
Backups, recovery, continuity plans and periodic tests aligned with the services that keep your business running.
Segmentation, MFA, vulnerability management, hardening, monitoring and detection, prioritised by real exposure.
Compliance dashboard and evidence repository ready for the supervisor, the auditor or the customer.
Engagement models
Four ways of working, depending on your starting point. We almost always begin with the assessment: it is short, it scopes the project and it stops you buying more than you need.
Applicability, evaluation of the Article 21 measures against your real situation and a risk-prioritised roadmap. The starting point when you do not know where you stand.
We lead and implement the programme with you: governance, policies, incident and third-party management, continuity and technical controls, until the evidence is verifiable.
If you already run a management system, we map NIS2 onto it and cover only the difference: reporting, management accountability, supply chain and resilience.
After alignment someone has to sustain it: committee, indicators, third-party reviews, reporting drills and updates as the Spanish law lands.
Methodology
Six phases, from applicability to maintenance. Each ends with a deliverable that management can approve.
Sector, size, services provided and position in the supply chain. We decide with documented criteria whether you are an essential entity, an important entity or an affected supplier, and which systems are in scope.
Interviews, document review and technical verification of the ten measures. Each gap gets a criticality and an estimated effort.
A 6-month plan prioritised by risk, with owners and budget. The management body approves it: that is its obligation and the first piece of evidence.
Minimum policies and procedures, incident reporting process, third-party management, continuity and technical measures. We work with your team and your suppliers.
A 24/72-hour reporting exercise, a continuity test and the evidence dashboard. We check the system works before a real incident tests it.
Compliance report for management, executive training and a maintenance plan with indicators. Optionally, recurring follow-up.
Deliverables
Classification as essential entity, important entity or affected supplier, with the reasoning you can present to customers and the authority.
Status of each measure, criticality, effort and required evidence. The document that structures the project.
6-month plan with owners, budget and the management body's approval minutes.
Significant-incident criteria, 24 h / 72 h / 1 month deadlines, templates and channel with the competent authority.
Risk management, third parties, continuity, access control, cryptography and cyber hygiene, at the minimum viable level.
Evidence repository, indicators for the committee and recorded training for the management body.
Regulatory context
Directive (EU) 2022/2555 had to be transposed by 17 October 2024. Spain missed the deadline and the European Commission referred the delay to the Court of Justice of the EU. While the draft Cybersecurity Coordination and Governance Act works its way through parliament, the directive is already the benchmark demanded by customers, insurers and tenders.
Our recommendation is to align with the directive now and adjust the details —competent authority, registration, penalties— once the Spanish law sets them. Those who wait for the law end up complying in a hurry, on someone else's deadlines.
NIS2 in Spain after the CJEU referral: what to do without a national law →Fit with other frameworks
Most companies affected by NIS2 already carry another framework. Our job is to make sure you do not pay twice for the same control.
If you serve the Spanish public sector, the ENS is mandatory and covers most of Article 21. NIS2 adds reporting, management accountability and supply chain.
ENS consulting →A certified ISMS is the best foundation for NIS2: Annex A controls cover most technical measures. What is missing is the regulatory fit and reporting.
ISO 27001 consulting →If you are a financial entity, DORA is lex specialis and prevails over NIS2. We explain it in the NIS2 vs DORA comparison.
DORA consulting →If you process cards, PCI DSS coexists with NIS2: one governs overall risk and the other the cardholder data environment. One evidence trail serves both.
PCI DSS consulting →Full comparison: ENS vs ISO 27001 vs NIS2 vs DORA · NIS2 vs DORA.
Planning
Timelines depend on the availability of your team and your suppliers to implement; the consulting work is rarely the bottleneck.
Concepts from our cybersecurity glossary that connect directly with this service.
In a 45-minute scoping session we review applicability, starting point and engagement model, and send you a fixed proposal.
Reviewed by Thilina Manana and Hard2bit's Compliance and GRC team
Last reviewed:
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
