NIS2 Compliance
for Businesses
We help you understand whether NIS2 applies to you, what you need to implement and by when.
NIS2: European scope
and preparing your business
Directive (EU) 2022/2555, NIS2, entered into force on 16 January 2023. Member States had to transpose it by 17 October 2024 and apply the national measures from 18 October 2024. These dates are not the date of entry into force of a Spanish transposition law.
In our review on 1 October 2026, the official sources consulted do not establish full transposition in Spain: on 8 July 2026 the Commission announced referral of Spain to the Court of Justice for failure to notify transposition. We assess enforceable obligations under the applicable rules and follow their development; we do not assume that the directive alone automatically imposes all its obligations or penalties on every business.
Scope depends on the type of entity, its size and the specified exceptions. Customers subject to cybersecurity requirements may also require assurances from suppliers through contracts, without automatically making the supplier a directly regulated entity.
Sources: NIS2 Directive and European Commission, 8 July 2026.
Does NIS2 apply to me?
Does your company operate in any of the Annex I or Annex II sectors?
Annex I (high criticality): energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT, space and public administration.
Annex II (other critical sectors): postal services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles), digital services and research.
If yes → go to question 2.
Is your business medium-sized or larger under the European criteria?
The general rule combines an entity type in Annex I or II with medium size or larger. Staff numbers, turnover and balance sheet totals are assessed under the European rules for partner and linked enterprises. Turnover alone is not enough.
Some entities are covered regardless of size. The exceptions and applicable rules must also be checked before deciding whether a business falls within scope.
Does a scope exception or a customer requirement apply?
Some entity types and criticality cases may be covered regardless of size. Being a supplier to an essential or important entity does not, by itself, determine that status.
Your customer may require security measures and evidence in its contract. We assess direct regulatory scope and contractual duties separately; an ICT provider may fall within scope through its own activity and size.
“SCOPE DEPENDS ON THE SERVICE, SIZE AND EXCEPTIONS”
What a properly implemented NIS2 programme requires
Risk governance
Documented identification and assessment of risks, with periodic reviews and reviews after relevant changes. This includes assessing direct suppliers and defining measures and commitments proportionate to the risk of each relationship.
Technical measures
Multi-factor authentication for critical access, encryption of sensitive data, vulnerability management, verified backups, access control based on least privilege and an asset inventory. The technical foundations every serious system needs, documented and auditable.
Incident management and continuity
Detection, response, continuity and recovery procedures. For significant incidents, Article 23 generally provides for an early warning within 24 hours and notification within 72 hours of awareness, followed by a final report within one month of notification. Exceptions apply, including for trust services, and ongoing incidents have specific rules. The recipient is the relevant CSIRT or competent authority.
Training and management accountability
Article 20 requires management bodies to approve and oversee the measures and receive training. The programme also includes cyber hygiene and appropriate staff training. Liability and supervisory measures depend on the applicable framework and the relevant procedure.
‘Very professional. We’ve been working together for many years and will continue to do so for many more!’
Companies
that already trust us
Yes, these are some of our clients
Six signs of
a poorly executed NIS2 compliance project
If the work comes down to filling in templates, drafting a policy document and sending you an invoice, they are selling you paperwork, not compliance. How to spot it.
They sell you “NIS2 certification” and call it done
The project is only documentary
They do not address the supply chain
They ignore Article 23 deadlines
There is no training for management
There is no continuous evidence plan
When it makes sense
to address your NIS2 compliance
When your sector appears in Annex I or Annex II
If your activity matches the entity types in Annex I or II, assess size, exceptions and applicable rules. This supports proportionate measures and a compliance timetable based on confirmed requirements.
When a client starts requiring it
A customer subject to cybersecurity requirements may request evidence and contractual commitments. We review what it needs, how to demonstrate it and the implications for your service, without treating that commercial relationship as automatic direct inclusion under NIS2.
When you already comply with ISO 27001 or ENS
Existing risk analysis, policies and controls can provide a useful foundation. We assess the actual gaps against the relevant scope and requirements, including suppliers, incident reporting and management training, without assuming a coverage percentage before reviewing them.
To prepare for requirements and reduce risks
Preparing an inventory, risk assessment and priority measures helps build evidence for the requirements that apply. We follow Spanish legislative developments and official publications to adjust the plan; we do not predict approval dates or retroactive inspections.
How we work through NIS2 compliance step by step
Initial assessment
- A 30-45 minute call to validate whether NIS2 applies to you, how intensely and what operational risks non-compliance creates. By the end, you have the criteria to decide whether to continue with us or with someone else. No long sales presentation —straight to technical judgement.
Gap analysis
- Technical and documentary review against the 10 points of Article 21. Interviews with IT, management and critical process owners. We deliver a report showing what you already comply with, what is missing and in what order to address it, with estimated effort and a fixed cost.
Compliance roadmap
- A roadmap prioritised by risk and impact, with phases, deadlines, owners and a fixed price per phase. No open-ended hour bundles. You choose the pace: all at once or in stages depending on budget availability.
Implementation
- Deployment of technical measures (MFA, encryption, verified backups, monitoring, SOC where applicable) and documentary measures (policies, playbooks, procedures, supplier contracts, training plan). The same team that performed the gap analysis leads the implementation.
Maintenance and continuous evidence
- Periodic internal audits, risk analysis updates, quarterly reports for management and preparation for supervisory review. NIS2 is not a project; it is a capability that must be sustained.
FAQs
about NIS2
We are small, so it does not affect us, right?
Activity and exceptions matter as well as size. The general rule concerns entity types in Annex I or II that are medium-sized or larger, assessed using staff numbers, turnover, balance sheet totals and business relationships. Some cases are included regardless of size. Being a supplier may create contractual requirements, but does not automatically make a small business a directly regulated entity.
We already comply with ISO 27001. Is that enough for NIS2?
ISO 27001 can provide useful policies, risk analysis and controls, but does not replace checking the applicable obligations. We review gaps, including incident reporting, governance and management training, and reuse evidence that remains relevant.
What if we already have ENS?
ENS can provide useful measures and evidence. Its scope is not identical to NIS2, so we review the overlap and the gaps, including suppliers, reporting and governance. An ENS certificate does not close the assessment by itself.
What happens if I do not comply and nobody inspects me?
An incident can cause operational losses and lead to supervisory action. Liability, potential penalties and contractual consequences depend on the applicable law, the facts and the procedure. They do not follow automatically from an incident. Our work focuses on reducing risk and maintaining verifiable evidence.
How much does NIS2 compliance cost?
It depends on your starting point. An initial assessment is free. A full gap analysis starts at a few thousand euros. Implementation varies enormously depending on your size, sector and current infrastructure: from €5,000-€15,000 for companies with a solid base to larger projects for companies starting from zero. We always provide a fixed price after the gap analysis, not an open-ended hour bundle.
How long does it take to implement NIS2?
As an indicative commercial estimate, an NIS2 compliance project for an SME may take between 3 and 9 months. This is neither a legal deadline nor a guarantee. The timetable is agreed after the initial scope and gap assessment, taking account of available resources, reusable ISO 27001 or ENS evidence and the applicable official requirements and deadlines.
Does islaNet subcontract NIS2 projects to another company?
No. We handle it from Palma with our own team: certified technicians (ISO 27001 Auditor, CISSP, CISA) and specialised legal consultants. When you hire us, the same team manages the project from assessment to continuous follow-up.
START WITH AN ASSESSMENT FOR
YOUR
COMPANY
A 30-minute call is enough for us to validate whether NIS2 applies to you, how intensely and give you a realistic cost range. If we are a good fit, we prepare a fixed proposal within a few days. If not, we guide you on what to look for.