NIS2 readiness
From NIS2 scoping to a board that can defend the programme, in one focused engagement.
NIS2 is the regulation Norwegian buyers ask about most, partly because the transposition timeline keeps moving. The work itself does not move. Here is what an essential or important entity has to deliver, and how I run a programme that lets the board stand behind it.
What we deliver
-
ScopingDetermines whether the entity is essential or important, and which obligations apply.
- Gap analysis against the core controls
We assess your existing controls against NIS2's core requirements and produce a prioritised list of what needs to close before the next supervisory visit.
-
Risk management and governanceWe build the risk register, write the policies your security team can put to use, and name a control owner for every requirement.
- Incident reporting
We build the decision tree for early warning, the 24 and 72 hour notifications, and the final report.
- Supply chain
Maps and governs security risk from critical suppliers and managed service providers.
- Board accountability
We design the board's reporting cadence, run the required training, and document oversight so the management body can stand behind the programme.
How we deliver this service
- In a project
Readiness assessment and roadmap with clear owners and dates.
- In a role at the customer
Programme owner inside the organisation through the Norwegian transposition.
- As part of a service
Included in the Secured by FM CyberSecurity bundle as an ongoing compliance programme.
Recent insights on NIS2 readiness
- How long does ISO 27001 take?
The work takes weeks, the waiting takes months. What an ISO 27001 run consists of, what sets the pace, and how to plan backwards from a tender deadline.
- How we use AI to get SMBs certification-ready in four to six weeks
AI drafts the documentation, our consultants adapt it with you, and the evidence gathers itself in a GRC tool. That is how the timeline holds up.
- ISO 27001 or NIS2 first?
A customer wants ISO 27001 and NIS2 is on the way. Build one management system, let the paying deadline set the order, and the same work carries both.