NIS2 consulting: comply with the EU cybersecurity directive

The NIS2 Directive reaches thousands of companies in Spain and its transposing law is on the way, with fines of up to 2% of global annual turnover or €10 million. Do you know whether your company is in scope and what you need to do?

Scope your project · Assess my NIS2 compliance

Rather talk it through? Call us at +34 960 730 013

Is your company subject to NIS2?

NIS2 greatly expands the scope compared to NIS1. It no longer affects only classic critical infrastructure. It now includes sectors such as manufacturing, food, distribution, digital services, cloud providers, waste management and many more. If your company operates in one of the 18 regulated sectors and exceeds certain size thresholds, you're probably in scope. And if you're a supplier to an in-scope company, the pressure also reaches you through the supply chain.

What our NIS2 consulting includes

  • Applicability analysis: we determine whether your company is in scope of NIS2 and in which category (essential or important)
  • Technical gap analysis: we compare your current security posture with the requirements of NIS2 Article 21
  • Organizational gap analysis: policies, procedures, incident management, supply chain
  • Prioritized compliance plan: what to do, in what order and with what resources
  • Documentation: security policies, asset register, incident notification procedures
  • Support with notification to the relevant supervisory authority

NIS2 compliance process, step by step

  1. Applicability analysis: We determine whether your company is in scope, in which sector and under which category (essential or important). It is the first step in any NIS2 compliance effort: skip it and you end up implementing too much or too little.
  2. Full gap analysis: We assess your current situation against the 10 security measures required by Article 21.
  3. Gap report: A document with each identified gap, its risk and its impact in case of non-compliance.
  4. Action plan: A roadmap with tasks, owners, deadlines and resource estimates for each pending measure.
  5. Implementation and documentation: We support the implementation of the technical measures and draft the mandatory documentation.

Deliverables

  • Applicability analysis report with legal justification
  • Technical and organizational gap analysis against NIS2 Article 21
  • Prioritized compliance plan with timeline and resources
  • Documentation: security policy, incident management, risk analysis
  • Support with notification to INCIBE/CCN or the relevant supervisory authority

Who is subject to it?

  • Medium and large companies in the 18 sectors regulated by NIS2
  • Public administrations and public sector entities
  • Digital service providers: cloud, CDN, DNS, data centers
  • Manufacturing, energy, transport, health and water companies
  • Supply chain of essential entities

Frequently asked questions about NIS2

Is NIS2 already in force in Spain?

The directive was due to be transposed by October 17, 2024, and Spain missed the deadline: the draft Law on the Coordination and Governance of Cybersecurity was approved in January 2025, but as of October 2026 it has not been published in the BOE (Spain's Official State Gazette), and the European Commission referred Spain to the Court of Justice of the EU in July 2026. Meanwhile there is no NIS2 penalty regime applicable to companies and Royal Decree-Law 12/2018 still applies. The obligations will arrive with the law and compliance takes months, which is why it pays to start before it is published.

What are the penalties for NIS2 non-compliance?

For essential entities: up to €10 million or 2% of global annual turnover, whichever is higher. For important entities: up to €7 million or 1.4% of global turnover.

How does NIS2 differ from the previous NIS1 directive?

NIS2 expands the sectoral scope, increases reporting obligations (notification within 24/72 hours), raises penalties, includes personal liability for management bodies and adds supply chain requirements.

Do we need a pentest to comply with NIS2?

NIS2 requires assessing security risks and applying appropriate technical measures. Penetration testing is one of the most solid ways to meet that obligation in a documented and verifiable way.

How long does it take to comply with NIS2?

It depends on your starting point. Companies with a solid security baseline can complete the process in 3-6 months. Organizations starting from scratch may need 12-18 months for full compliance.

What timeline does NIS2 compliance follow in Spain?

Right now the timeline is set not by a date in the Spanish law, which has yet to be published, but by two things: your starting point and your customers, who, if they are regulated entities, are already passing requirements down by contract. We recommend closing the applicability analysis and the gap analysis within 4 to 6 weeks, so you have a plan with defensible deadlines on the day the law comes into force, even if implementation then runs for several months.

What is the difference between being in scope as an essential or an important entity?

The Article 21 security requirements are the same for both. What changes is supervision and the penalty regime: essential entities face proactive supervision and fines of up to €10 million or 2% of global turnover; important entities face reactive supervision — after an incident or a complaint — and fines of up to €7 million or 1.4%. Determining the correct category is part of the applicability analysis.

Related resources

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Assess my NIS2 compliance