NIS2 Compliance
Comprehensive guidance to achieve and maintain compliance with the European NIS2 cybersecurity directive.
10 domains — Article 21.2
- aRisk analysis and security policiesCovered
- bIncident handlingGap
- cBusiness continuity and crisis managementCovered
- dSupply chain securityGap
- eSecurity in acquisition and developmentGap
- fEffectiveness assessment of measuresCovered
- gCyber hygiene and trainingCovered
- hCryptography and encryptionGap
- iHR, access control and asset managementCovered
- jMFA and secure communicationsCovered
Illustrative example (Energy sector, large size): 6/10 domains covered, a sector-average estimate — not a real client figure. Calculate yours in the self-check below.
The challenge
The NIS2 directive broadens the scope of its predecessor and now reaches over 160,000 organizations across Europe. Companies in essential and important sectors — energy, transport, manufacturing, food, healthcare, and digital services — must demonstrate a measurable, auditable level of cybersecurity management.
The requirements are broad and technically demanding: risk management, supply chain security, incident reporting within 24/72 hours, business continuity, board-level governance, and training. Most organizations aren't sure whether they're in scope (essential vs. important) or what their current gap is against the 10 Article 21 domains.
The good news: NIS2 is an achievable target with a plan. Knowing what applies to you, measuring your starting point, and prioritizing the controls that reduce the most risk turns a vague obligation into a clear roadmap.
What makes us different
Four pillars that apply to every service and every solution, not a one-off slogan.
Offensive + defensive + AI
The same team that attacks in the pentest runs the SOC and builds the AI models. Offensive insight informs defense, and AI is applied where we already operate, not bolted on as an extra layer.
Compliance in weeks, not months
HodeiShield, our own platform, automates continuous assessment, control mapping, and evidence generation — so manual work no longer sets the pace of regulatory compliance.
Sovereignty and proximity
Infrastructure on OVHcloud (France/EU). You speak with the people who sign off on the work, not an account manager who forwards your request to another department.
Our own product
HodeiShield isn't a third-party product we resell: we build and operate it ourselves, and that's what lets us offer faster compliance and evidence that's always current.
Our approach
Our approach starts with a thorough gap analysis against NIS2's specific requirements, assessing your current posture across each key area: risk management, supply chain security, incident response, business continuity, governance, and training. HodeiShield automates the continuous assessment of your security posture against NIS2 controls. HodeiShield includes automatic incident classification (Art. 23 NIS2), cross-framework with ENS via CCN's PCE-NIS2, and an evidence pack ready for the competent authority.
Using the gap analysis as a foundation, we design a prioritized compliance roadmap that balances implementation effort with risk reduction. This isn't about checking boxes: we implement controls that genuinely improve your security, not just your compliance level on paper.
We support the implementation end to end: from drafting policies and procedures to technical control configuration, team training, and audit preparation. Our team acts as an extension of your organization throughout the entire process.
How we deliver
Structured methodology for measurable outcomes.
Gap Analysis
We assess your current posture across each key NIS2 area: risk management, supply chain security, incident response, business continuity, governance, and training.
Compliance Roadmap
We design a prioritized roadmap balancing implementation effort with risk reduction. We implement controls that genuinely improve security, not just paper compliance.
Implementation & Audit
We support implementation end to end: policies, technical control configuration, team training, and audit preparation.
Benefits
Tangible outcomes for your organization.
Powered by HodeiShield
HodeiShield automates third-party risk management (Article 21.2.d) and incident reporting with regulatory deadlines. Evidence dashboard ready for CCN-CERT audits.
Discover HodeiShieldMethodology: how we implement it
Discovery, execution, delivery and follow-up — a clear path to continuous operation.
Gap analysis
NIS2 mapping with ENS/ISO cross-framework.
Control implementation
10 domains of Article 21, technical and organizational measures.
Governance and training
Management accountability, annual training, playbooks.
Continuous monitoring
Evidence, reporting, and regulatory reviews.
Operational example
A real scenario of how we work, not a marketing figure.
Anomalous activity is detected on an internet-facing server on a Friday night. The team classifies the incident against NIS2 Article 23's criteria, documents the impact, and — if it turns out to be significant — prepares the early warning within the directive's 24-hour window, with the evidence trail already structured instead of reconstructed at the last minute.
Compared to a generalist integrator
No names — here's how we work differently, with verifiable facts.
| Criteria | Generalist integrator | Hodeitek |
|---|---|---|
| Focus | Dozens of business lines; cybersecurity is just one of them | 100% cybersecurity and AI |
| Point of contact | An account manager who forwards your request to another department | Direct contact with the founders |
| Regulatory compliance | One-off reports per regulation, manual evidence management | HodeiShield automates evidence and cross-framework NIS2/ENS/DORA mapping |
| Product | Resells third-party licenses | Builds and operates HodeiShield, its own platform |
Frequently asked questions
What's your response SLA?
Who does NIS2 apply to?
What is the difference between essential and important entities?
How long is there to report an incident?
Can I reuse my ENS compliance for NIS2?
How long does NIS2 compliance take?
How is NIS2 compliance priced?
Does NIS2 apply the same way to every sector?
How are you different from a generalist integrator?
Reach NIS2 with a clear plan
Talk to our team to evaluate how this solution can protect your organization.
Response within 24h
Complementary services
Related solutions
DORA Compliance for Financial Entities
The Digital Operational Resilience Act requires 22,000+ financial entities to actively manage third-party ICT risk since January 2025. HodeiShield automates the Information Register, classifies incidents automatically, and keeps evidence ready for ESA inspection.
Spanish National Security Framework for the Public Sector
Hodeitek's team are Spanish regulatory specialists: the National Security Framework (Esquema Nacional de Seguridad, or ENS) is a Spain-only requirement set by Spain's National Cryptologic Center (CCN), not a European or international standard, and it matters if you operate in Spain or sell to its public sector. The ENS is mandatory for all Spanish public administrations and their technology vendors — HodeiShield is the only platform with native ENS, with mapped controls, linked evidence, and automated system profiling.