Out of the 314 Registered ISACA CMMI Partners, Only 14 Hold Elite Status, and CUNIX is Proud to be One of Them

NIS2 Compliance Service

Contact Form

Strengthen Your Cybersecurity. Meet NIS2 Requirements.

The NIS2 Directive raises the cybersecurity bar across the European Union. It extends to more sectors.

and organizations than before, sets stricter security and reporting duties, and makes senior management personally accountable for compliance.

Cunix helps you understand where you stand, close the gaps, and build a security programme that

satisfies regulators and protects your business.

Who Needs to Comply with NIS2?

NIS2 applies to medium and large organizations in sectors considered essential or important, including:

Essential sectors: Energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, and space.
Important sectors: Postal and courier services, waste management, chemicals, food production and distribution, manufacturing, digital providers, and research.

Requirements and supervision differ between “essential” and “important” entities, and national laws

vary by member state. We help you determine your classification and obligations.

Our NIS2 Services

1. NIS2 Applicability & Scoping Assessment

We determine whether you fall within scope, how you are classified, and which national requirements apply.

2. Gap Assessment & Roadmap

We evaluate your current security posture against NIS2’s minimum measures and deliver a prioritized, practical action plan.

3. Cybersecurity Risk Management

We help you implement the measures NIS2 requires, including:

Risk analysis and information security policies
Business continuity, backup, and crisis management
Access control and asset management
Cryptography and encryption
Secure development and vulnerability handling
Multi-factor authentication and secure communications

4. Incident Detection, Response & Reporting

We build incident response capabilities and reporting workflows aligned with NIS2 timelines: early warning within 24 hours, incident notification within 72 hours, and a final report within one month.

5. Supply Chain & Third-Party Security

We assess supplier risk, strengthen contractual security requirements, and set up ongoing oversight of your critical vendors.

6. Management Accountability & Training

NIS2 requires management bodies to approve and oversee cybersecurity measures. We provide board-level briefings and training to meet this obligation.

7. Audit Readiness & Ongoing Compliance Support

We prepare your documentation and evidence for supervisory reviews and support continuous improvement.

Our Approach

Scope: Confirm applicability and classification.
Assess: Identify gaps against NIS2 requirements.
Remediate: Implement policies, controls, and processes.
Train: Equip leadership and staff.
Maintain: Monitor, test, and improve over time.

What You Receive

Scoping and classification report
Gap assessment and remediation roadmap
Information security and risk policies
Incident response plan and reporting templates
Supplier risk assessment framework
Management training and awareness materials

Why Choose Cunix?

Is NIS2 already in force?

NIS2 entered into force in January 2023, and Member States had to transpose it into national law by 17 October 2024. Transposition status varies by country, so we help you track the rules that apply to you.

What are the penalties for non-compliance?

Penalties can be substantial. For essential entities, fines can reach €10 million or 2% of global annual turnover, whichever is higher. For important entities, the limits are €7 million or 1.4%. Management may also face personal accountability measures.

Does NIS2 apply to small businesses?

Generally it targets medium and large entities, but some smaller organizations may be in scope depending on their sector and role. We can check this for you.

We already follow ISO 27001. Is that enough?

ISO 27001 is a strong foundation, but NIS2 has specific requirements, such as reporting timelines and management accountability. We can map what you have and close the remaining gaps.

Not Sure Where to Start?

Contact Now