Who is affected by NIS2?

NIS2 applies to organizations in 18 defined sectors (energy, health, finance, transport, digital services and others) with at least 50 employees or €10 million in annual revenue. Suppliers and service providers to these organizations are also affected. In Germany, the directive is implemented via the NIS2UmsuCG. Many mid-market companies underestimate that they are affected indirectly through supply chains.

What are the NIS2 fines for non-compliance?

NIS2 foresees fines of up to €10 million or 2% of global annual revenue (essential entities), respectively €7 million or 1.4% of revenue (important entities). In addition, management is personally liable for the implementation of security measures.

How long does NIS2 compliance implementation take?

A complete NIS2 compliance program typically takes 6–12 months: gap analysis 3–4 weeks, prioritized quick wins 2–3 months, structural measures (governance, risk management, incident response, supply chain security) 4–9 months. We focus first on the largest compliance gaps.

What is the difference between Zero Trust and a classical firewall solution?

Classical security relies on perimeter protection: everything inside the internal network is considered trustworthy. Zero Trust reverses this principle — every access is verified, regardless of location. Based on identity, device state and context. Particularly important for remote work, cloud services and SaaS — where the classical perimeter no longer exists.

Cybersecurity & Compliance

Security that grows with you - proactive and future-proof.

Challenges

Security & Compliance

Increasing Cyber Threats

Compliance requirements are growing

Identity Vulnerability

Lack of Visibility

Unprotected Sensitive Data

Shortage of Security Experts

Services

Services in detail

Trust is not a security strategy. We implement a security model that verifies every access, regardless of whether it comes from inside or outside. Scaled to your company size, whether SME or enterprise.

Identity First SecurityLeast Privilege & Just in Time AccessNetwork & Access ControlSecurity Baseline & Monitoring

Identity is the first line of defense. We ensure that only the right people access the right resources at the right time - passwordless, context-based, and traceable.

Passwordless AuthenticationIdentity Governance & LifecycleSSO & App IntegrationPrivileged Access Management

Detect threats before they cause damage. We implement monitoring and detection based on Microsoft Sentinel, Defender, and CrowdStrike - scaled to your requirements, from the first alert to automated response.

Security Monitoring & AlertingSIEM & Log IntegrationVulnerability ManagementIncident Detection & Response

Know where your sensitive data resides and ensure it stays there. We implement protective measures and compliance frameworks that withstand GDPR, ISO 27001, or investor due diligence.

Data Classification & LabelingData Loss Prevention (DLP)Compliance Assessments & AuditsEncryption & Data Security

Understand first, then act. We analyze your security architecture and develop a roadmap that fits your priorities and resources.

Security Status Quo AnalysisSecurity Roadmap DevelopmentCertification PreparationRisk & Vulnerability Assessment

References

Related projects from our practice

Energy supply

Security Modernization with a Focus on Microsoft 365 & SOC Readiness

FAQ

Frequently asked questions about Cybersecurity & Compliance

If your employees work remotely, use cloud services, or process sensitive data: yes. Zero Trust is not a trend, but the answer to a changed threat landscape.

Yes, we accompany you from the gap analysis through implementation to audit preparation. Many of our clients have successfully certified with our support.

If you use our Managed Security Services, we react immediately. We analyze the incident, contain it, and support you in recovery. For everyone else, we offer incident response on demand.