Confirm NIS2 applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Security · EU member states
EU NIS2 Directive
Essential and important entities in the EU, and the US vendors that serve them, carry management-level cyber duties.
Rather skip the call? Get a fixed-fee NIS2 quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry NIS2, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no NIS2 package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the NIS2-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what NIS2 expects you to have in place.
- Management that answers for itThe management body approves the cybersecurity measures, oversees them, takes training, and can be held liable.
- Risk-management measuresRisk analysis and security policies, incident handling, and checks that the measures actually work.
- Business continuityBackups, disaster recovery and crisis management that have been tested.
- Supply chain securityThe security of each direct supplier and service provider, assessed and written into the relationship.
- Basic hygiene and accessStaff training, access control, asset management, multi-factor authentication and encryption where it fits.
- Incident reporting on a clockAn early warning to the national authority within 24 hours of a significant incident, a notification within 72 hours and a final report within a month.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for NIS2
NIS2 reaches a US company mostly through its customers: EU entities must manage supply chain risk, so their questionnaires now ask for risk management, incident handling, business continuity, MFA, encryption and training, with an early warning within 24 hours of a significant incident.
We build the control set once and answer the questionnaires from it.
Who asks: tick what is true
Tick what applies and we show which NIS2 measures your customers will ask for.
The steps
Six steps from "does NIS2 apply to us?" to evidence you can show
The whole NIS2 journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- Laptops encryptedPassing
- MFA on every accountPassing
- Backups restored this quarterPassing
- Access reviewed this quarterPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for NIS2
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What NIS2 costs, in plain numbers
Here is what is published, with who published it and when.
$0There is no NIS2 certificate; member state authorities supervise. The cost is the controls and the evidence.Source: EU NIS2 Directive (EU) 2022/2555
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on NIS2, in plain words.
Questions
NIS2 questions we get every week
What is NIS2?
Directive (EU) 2022/2555, the EU law on a high common level of cybersecurity. It replaced the first NIS Directive and covers medium and large entities in the sectors listed in its two annexes, from energy and health to digital providers and manufacturing. Each member state applies it through its own national law.Source: NIS2 text, EUR-Lex
What does NIS2 require of covered entities?
Risk management measures under Article 21, including incident handling, business continuity, supply chain security, encryption and multi-factor authentication; incident reporting under Article 23; and management accountability under Article 20, where leaders approve the measures and can be held responsible.Source: NIS2 text, EUR-Lex
How fast must incidents be reported under NIS2?
For a significant incident: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. A US supplier is rarely the one filing, but customers will write the same clocks into your contract.Source: NIS2 text, EUR-Lex
What should a US supplier do first?
Find which customers are in scope and what they now ask of you, then answer from one mapped control set: incident response with clear notice times, MFA, encryption, vendor management and continuity. ISO 27001 or SOC 2 evidence answers most NIS2 supplier questionnaires.
Do you certify NIS2 compliance?
No. NIS2 is enforced by national authorities in each member state, and there is no NIS2 certificate. We prepare the security program and the evidence your EU customers ask for, and work with your counsel on the legal questions.
Where do we start with NIS2?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do NIS2 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Security: SOC 2 · NIST CSF 2.0 · ISO 27001 · CIS Controls · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for NIS2.
Book the demo and see how one control set carries NIS2 and everything else you owe. Or leave your details and an engineer replies within one business day.