NIS2 doesn't ask if you have a SOC. It asks if you can prove it works.

For essential and important entities, NIS2 turns incident response, risk management and supply-chain security from best practice into legal obligation, with board-level liability attached.

What NIS2 readiness involves

• Gap assessment against NIS2, Germany's NIS2UmsuCG and sector frameworks including KRITIS
• Incident response and reporting procedures aligned to statutory timelines
• Governance documentation ready for auditors and supervisory authorities
• Technical controls validated through threat-informed testing, not paperwork alone
• Regulatory and legal groundwork from a team member with a background in law

National transpositions differ — we assess per country

NIS2 is an EU directive, but it takes effect through national law, and the timelines and specifics differ. Germany's NIS2UmsuCG and KRITIS regime, Austria's NISG 2024, Denmark's NIS2-loven, Finland's national framework, and Sweden's Cybersäkerhetslagen each carry their own obligations. Switzerland sits outside NIS2 entirely, though its revised Information Security Act (ISG) pushes critical-infrastructure operators toward a comparable operational bar.