EU cybersecurity

Turn EU cyber obligations into an accountable program.

The NIS2 Directive expands and strengthens cybersecurity risk management and reporting obligations for covered entities in the EU. Applicability depends on sector, size, national implementation, and other facts. We help establish the right scope and operational response.

Our implementation focus

Make the requirements operational.

  1. 01

    Assess applicability with legal and sector input

  2. 02

    Map governance and cybersecurity risk measures

  3. 03

    Strengthen incident handling and escalation

  4. 04

    Address supply chain and supplier security

  5. 05

    Build evidence and management oversight

Independent assessment

National implementing rules vary. Regulatory interpretation should be reviewed with qualified legal counsel.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 04

Establish applicability

Identify services, sectors, entity size, group structure, and the EU countries in which operations may fall within national NIS2 implementing rules. Confirm the legal position with local counsel.

Output: Entity and jurisdiction assessment
02 / 04

Set accountable governance

Assign management oversight and owners for cyber risk, training, policies, and evidence. Connect NIS2 decisions to existing information security and resilience governance.

Output: Responsibility map and prioritized gap register
03 / 04

Implement risk measures

Review incident handling, continuity, supply-chain security, vulnerability management, access, cryptography, and effectiveness checks against the applicable national measures.

Output: Owned controls and operating records
04 / 04

Rehearse response

Test escalation and reporting workflows, including who decides whether an event is reportable and how information will be assembled under the relevant national rules.

Output: Exercise results and improvement plan

Questions we hear

Get the distinctions right.

Is NIS2 the same as NIST CSF 2.0?

No. NIS2 is an EU directive implemented through national law. NIST CSF 2.0 is a voluntary cybersecurity risk framework. The framework can help organize work, but it does not determine legal applicability or compliance.

Does ISO/IEC 27001 certification prove NIS2 compliance?

No. An ISMS can support risk management and evidence, but NIS2 obligations depend on the entity, sector, and national implementing law. Evaluate the remaining duties explicitly.

Should every supplier claim to be NIS2 compliant?

No. First establish whether the supplier is directly in scope, affected through customer contracts, or both. Describe the specific controls and evidence available instead of making a blanket claim.

National context

Follow the applicable law.

NIS2 is implemented through Member State law. Start with the entity and its relevant jurisdictions.

GermanyAI management system and service assurance implementation for German technology providers, with BSI cloud criteria and ISO/IEC 27001 context. Includes national NIS2 status and implementation context.FranceAI governance, service assurance, privacy, and cloud security implementation considerations for French technology providers. Includes national NIS2 status and implementation context.NetherlandsAI governance and service assurance implementation for Dutch technology providers, with BIO2 and Cyberbeveiligingswet context where relevant.SpainAI management, service assurance, and security management for Spanish technology providers, with ENS and AEPD context where applicable. Includes national NIS2 status and implementation context.ItalyAI management and customer assurance implementation for Italian technology providers, with AgID public-sector AI context where relevant. Includes national NIS2 status and implementation context.PolandAI management, service assurance, and information security implementation for Polish organizations assessing KSC/NIS2 duties.BelgiumBelgian AI governance and service assurance implementation alongside CCB CyberFundamentals and NIS2 context.

Practical guidance

Read the next decision.

Executive briefing3 min read

NIS2

NIS2: the first decisions that matter

A clear starting point for applicability, governance, incident processes, and supplier security.

Read resource
Executive briefing5 min read

NIS2

NIS2 supplier security and incident readiness: build the operating record

A practical route from NIS2 applicability to supplier oversight, incident decisions, and evidence across an EU operating footprint.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation