NIS2 Compliance Assessment

Understand your gaps and prioritize key requirements for NIS2 compliance with guidance from Kroll experts.

Explore Cyber and Data Resilience

Get a Quote

NIS2 replaces the original NIS Directive from 2016, which sought to set a high level of cybersecurity across critical infrastructure across the EU. NIS2 is an important update, with the original NIS directive considered to have limited scope and lack of consistency in its application by member states. NIS2 therefore includes an expanded scope of EU impacted entities and a wider supervisory and coordinated regime from member states which entities will need to register with.

How has NIS2 changed from NIS Directive ?

Requirements	NIS Directive	NIS2 Directive
Risk Management Requirements	Required entities to implement "appropriate and proportionate" security measures	Imposes stricter requirements, focusing on: Supply chain security and third-party risks Incident response planning Encryption Business continuity
Sectors in Scope	Banking Healthcare Energy Transport Digital Service Providers Water Supply Digital Infrastructure	Expanded scope adding the following new sectors: Space Public Administration Waste and Wastewater Management ICT Service Management Providers of Public Electronic Communications Networks or Services Chemicals Food Research Postal and Courier Services
Reporting Requirements	Reports cyber incidents to national authorities within a reasonable timeframe	Incidents reported within 24 hours Follow-up reports required after 72 hours Final detailed report within a month
Penalties	Allowed member states to set penalties for noncompliance	Essential Entities - up to €10 million euros or 2% of global annual turnover Important Entities - up to €7 million or 1.4% of their global annual turnover

How Kroll Can Help You Achieve NIS2 Compliance

Kroll has a long track record of working with organizations across critical infrastructure sectors, enabling them to achieve their security and regulatory goals across multiple jurisdictions. We leverage agile methodologies and accelerators and frontline intelligence from thousands of incident response cases a year, to provide support and prepare your organization to meet NIS2 requirements.

Key Outcomes

Understand Your Maturity in Relation to NIS2 Requirements.

Have a Clear Roadmap to NIS2 Compliance While Reducing Longer Term Risk

Implement Remedial Measures to Maintain Cyber Resiliency

How It Works

Our three-phased approach helps organizations of all sizes address any stage of NIS2 compliance:

Gap Assessment

As part of our gap assessment, we provide a clear risk rating against NIS2 requirements, whilst giving a quantitative measure of compliance status covering:

Governance

Allocation of responsibilities (board, committees and individuals)
Training of management and all employees

Cyber Risk Management

Designing, developing, availability and consideration of risk in systems
Supply chain security
Basic cyber hygiene, encryption, access and HR security
Existence of comprehensive policies and procedures for risk management

Reporting and Registering Articles

Reporting incidents
Reporting vulnerabilities
Collaboration
Registration
Breach notification

Roadmap

Off the back of the assessment, we provide you with a roadmap report along with an action tracker for effective project management including:

Target levels of compliance and maturity in each assessment area
Actionable tasks with effort ratings
Reasonable timeframes for completion of individual tasks
Recommend task owners

Implementation and Remediation

Having identified NIS2 compliance key gaps, Kroll can assist with senior advisory support with regards to compliance adherence of remediation initiatives such as:

Program design and assessments
Business continuity and disaster recovery
Third-party risk management (due diligence assessments, third-party monitoring, contractual risk review etc.)

Kroll can also support with the review and development of policies, procedures, reports, mappings and risk assessments, leveraging specially-tailored templates.

NIS2 Compliance Assessment in Your Cyber Risk Retainer

Our NIS2 Compliance Assessment, along with many other cybersecurity and compliance services, can be delivered as part of Kroll’s ultra-flexible Cyber Risk Retainer. In addition to prioritized access to Kroll’s elite digital forensics and incident response team ahead of and in the event of an incident, the Retainer can also be used for services like penetration testing, risk assessments and tabletop exercises, to name just a few.

Why Kroll?

Experience in Building Multi-jurisdictional Governance Programs

Our team consists of experts who have designed and led numerous compliance audits at large multi-jurisdictional organizations, assessing and evaluating domains across cyber strategy, governance and procedural controls in the context of regulatory requirements and industry standards including ISO27001, COBIT and NIST, DORA, NIS2, SAMA CSF and more.

Experienced, Accredited Cybersecurity Professionals

700+ skilled and certified cybersecurity experts across the globe, experienced in not only helping clients comply with multiple regulations but staying resilient ahead of the changing landscape.

Solutions across the NIS2 Maturity Lifecycle

Our solutions can address all aspects of NIS2 compliance and maturity; from assessing all possible gaps/weaknesses and advising on remediation with our consultancy expertise to implementing the right controls and services.

Unrivalled Frontline Intelligence

With unrivalled exposure to thousands of incident response cases each year, we know what’s needed to stay resilient to cyber threats.

Fast Implementation, Built on Previous Engagements

We leverage our NIS2-tailored policies and procedures templates to provide immediate value as we roll out your tailored program.

Talk to a Kroll Expert

Kroll is ready to help, 24x7. Use the links on this page to explore our services further or speak to a Kroll expert today via our 24x7 cyber hotlines or our contact page.

Cyber Hotlines

Connect With Us

Tiernan Connolly

Managing Director

Cyber and Data Resilience

Dublin

+353 14283125 Tiernan Connolly

Colin Sheppard

Regional Managing Director, EMEA

Cyber and Data Resilience

London

+44 2070295072 Colin Sheppard

Craig Parkin

Associate Managing Director

Cyber and Data Resilience

London

+44 2070890960 Craig Parkin

Stay Ahead With Kroll

Cyber and Data Resilience

Incident response, digital forensics, breach notification, security strategy, managed security services, discovery solutions, security transformation.

Cyber and Data Resilience

Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.

Compliance and Regulation

Financial Services Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate, drive efficiencies and remediate operational, legal, compliance and regulatory risk.

Financial Services Compliance and Regulation

Cyber Governance and Strategy

Manage cyber risk and information security governance issues with Kroll’s defensible cyber security strategy framework.

Cyber Governance and Strategy

Threat Exposure and Validation

Proactively identify your highest-risk exposures and address key gaps in your security posture. As the No. 1 Incident Response provider, Kroll leverages frontline intelligence from 3000+ IR cases a year with adversary intel from deep and dark web sources to discover unknown exposures and validate defenses.

Threat Exposure and Validation

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Cyber Risk Retainer