NIS2 Consulting for German SMEs: From Applicability to Evidence
Our NIS2 consulting takes you through a fixed-price package: from a documented applicability assessment and a gap analysis against § 30 BSIG (German Act on the Federal Office for Information Security) to an audit-ready evidence package for your management and the BSI (Germany's Federal Office for Information Security). We set the fixed price after a brief review of your company size and starting point. And it is urgent: the German NIS2 Implementation Act (NIS2UmsuCG) has been in force since December 6, 2025, with no transition period, and management is personally liable for implementation.
Book a free initial consultation
In a free 45-minute initial consultation, we clarify whether you are in scope, where you stand and what the sensible next step is.
Who is our NIS2 consulting for?
NIS-2 applies to companies in the sectors listed in Annexes 1 and 2 of the BSIG, generally those with 50 or more employees or more than €10 million in annual revenue and annual balance sheet total. Depending on size and sector, they are classified as important or essential entities. Which obligations follow from this is explained in our article on the NIS-2 requirements.
Typical starting points in our projects:
- You already have an ISMS under ISO 27001 or a TISAX® label and want to know what is still missing for NIS-2.
- You do not have an ISMS yet and need a structured path to the obligations under the BSIG.
- You are not directly in scope, but your customers require NIS-2-ready security measures and contract clauses from you as a supplier.
- Your management needs a sound basis for approving, monitoring and evidencing the measures.
Our approach in six steps
- Initial review and scoping: In the initial consultation and a brief review, we record your size, locations, sector and existing management systems. This determines your fixed price.
- Kick-off workshop: Together with management and the responsible staff, we define scope, roles and timeline.
- Applicability assessment and BSI registration: We document your classification as an important or essential entity as evidence for management and support you with registration at the BSI.
- NIS-2 gap analysis: We compare your current state against the measures required by § 30 BSIG and prioritize the gaps by risk (details in the next section).
- Implementation support: We support the implementation of the delta measures, from the incident reporting process and governance documentation to supply chain security.
- Completion and evidence: You receive a report, a management presentation and an audit-ready evidence package.
How a NIS-2 project is generally structured and which tasks fall to your internal team is described in our guide to NIS-2 implementation (in German).
NIS-2 gap analysis: where you stand today
The NIS-2 gap analysis is the core of our package. It shows which obligations you already meet, where gaps exist and in which order you should close them.
What the gap analysis covers
- Risk management measures under § 30 BSIG: including risk analysis, incident handling, business continuity, supply chain, access control, cryptography and training.
- Obligations beyond the ISMS: registration with the BSI, an incident reporting process that meets the statutory deadlines, and management's obligations under § 38 BSIG.
- Scope: Under NIS-2, the scope cannot be chosen freely. We check whether all systems you use to deliver your services are covered, including production and control systems.
With or without an existing ISMS
If you already have an ISMS under ISO 27001 or a TISAX® label, we perform a delta analysis: we give credit for what is already operating effectively and focus on what NIS-2 additionally requires. Without an existing ISMS, we assess your current state against the minimum measures and determine which basic structures need to be built first. For a complete build-out, we support you with setting up your ISMS.
Internal self-assessment or external gap analysis?
A self-assessment using our NIS-2 checklist (in German) is a good starting point for collecting questions and clarifying responsibilities. But it does not replace an independent evaluation: internal teams often lack a benchmark, and existing policies are easily mistaken for effective ones. The external gap analysis delivers a traceable maturity rating that holds up in front of management, customers and regulators.
The outcome of the gap analysis
- Report with a rating for each area of measures
- Prioritized action plan with owners and timeline
- Management presentation as a basis for budget and resource decisions
What does the NIS-2 gap analysis cost?
NIS-2 gap analysis: €6,900 fixed price, or €4,500 as a delta analysis on an ISMS built, managed or audited by 360DT – including applicability check, comparison against the measures under § 30 BSIG, management obligations under § 38 BSIG, incident reporting process, and a prioritized action plan with management summary.
For corporate groups, multiple EU countries, OT environments or companies with 200 or more employees, we prepare an individual quote.
What you get with the “NIS-2 Compliance” fixed-price package
| Component | What you get |
|---|---|
| Applicability assessment | Documented classification as an important or essential entity, as evidence for management |
| Gap or delta analysis | Comparison of your ISMS (ISO 27001 / TISAX®) against the measures under § 30 BSIG, or a structured start without an existing ISMS |
| BSI registration | Support with registration at the BSI |
| Incident reporting process | Process for security incidents, aligned with the 24-hour, 72-hour and one-month deadlines |
| Governance documentation | Documents for management under § 38 BSIG: approval, monitoring and evidence of the measures |
| Supply chain security | Security requirements for suppliers and suitable contract clauses |
| Management briefing | Overview of liability, compliance roadmap and audit-ready evidence package |
Format: Kick-off workshop, support with implementing the delta measures, report and management presentation. Price: Fixed price after scoping, from €12,000, depending on the size and complexity of your company.
Optional components
- Management training under § 38 BSIG: Regular training is required by law. We offer it as e-learning or in person.
- Ongoing NIS-2 support as a vCISO: After the project, we take over continuous management and improvement as your external CISO.
For emergencies
- Incident response tabletop exercise: We walk through a security incident with your responsible staff and test reporting channels and deadlines along the way.
- Technical network audit: Together with a technology partner, we examine your network infrastructure for technical vulnerabilities.
Why 360DT?
- Experience since 2019: We have worked in information security since 2019 and have supported more than 50 clients, primarily with ISO 27001 and consulting on TISAX®. These are exactly the systems that form the basis of NIS-2 implementation for most companies.
- Certified ourselves: 360 Digitale Transformation GmbH has been ISO 27001 certified since July 2025 (certification body: Proks Certification GmbH, certificate DE-IS-20250158). Read how it went in our ISO 27001 certification.
- An auditor's perspective: Our managing director Can Adigüzel is an ISO 27001 Lead Auditor with more than 200 audits. We build evidence the way auditors read it.
- Clear boundaries: We provide a professional assessment of applicability and obligations. This does not replace a case-specific legal review.
Download the NIS-2 checklist for free
Want to take stock yourself before the consultation? Our NIS-2 checklist covers seven main criteria with sub-items, from security policies to management obligations. You will receive the download link by email. You can find more about the checklist's content on the NIS-2 checklist (in German) page.
Frequently asked questions about NIS2 consulting
How much does NIS2 consulting cost?
We work with a fixed price after scoping, from €12,000. The price depends on company size, number of locations, the complexity of your IT and OT landscape and the maturity of any existing ISMS. After a brief review, you receive a binding quote with no hidden costs. The NIS-2 gap analysis on its own costs €6,900 fixed price, or €4,500 as a delta analysis on an ISMS built, managed or audited by 360DT.
How long does NIS-2 implementation take?
Depending on maturity and starting point, you should expect three to twelve months until you can provide evidence. Companies with an actively operated ISMS under ISO 27001 or a TISAX® label are usually faster, because a large part of the measures under § 30 BSIG is already covered.
Can you support us without an existing ISMS?
Yes. Without an ISMS, we first assess your current state against the minimum measures and determine which basic structures need to be built first, such as risk management, the incident reporting process and responsibilities. We then support the build-out step by step.
Is management personally liable?
Yes. Under § 38 BSIG, management must approve the risk management measures, monitor their implementation and regularly attend training. If it culpably breaches these obligations, it is liable to the entity for the resulting damage. That is why our package includes governance documentation and a management briefing on liability.
What is the difference between a NIS-2 check and implementation?
A check, whether internal with a checklist or external as a gap analysis, shows where you stand and what is missing. Implementation closes these gaps: introducing processes, creating documentation, training responsible staff and collecting evidence. Our package covers both, starting with the gap analysis.
We missed the BSI registration. What now?
The registration deadline for most companies ended on March 6, 2026. If you are in scope and not yet registered, you should complete the registration immediately, because violations can be punished with fines. We support you with this and, in parallel, clarify which other obligations are still open.
Next step: your NIS-2 assessment
In a free 45-minute initial consultation, we clarify whether and how you are in scope, where you stand and what scope makes sense for your fixed-price quote.