NIS2
NIS2 readiness, on the security foundation you already run.
Risk management, incident reporting and management accountability, mapped to your ISO 27001 controls.
What we do for you
- Scope check (essential or important entity)
- Risk-management measures (Art. 21)
- Incident reporting with 24-hour, 72-hour and one-month deadlines (Art. 23)
- Supply-chain security register
- Management training and sign-off records
Why AnnexOps
Using AI in critical services? We assess your AI systems under NIS2 and the AI Act together.
Frequently asked questions
Does NIS2 apply to us?
It depends on your sector and size. NIS2 covers medium-sized and large organisations in the sectors listed in its Annexes I and II, such as energy, transport, banking, health, digital infrastructure, ICT service management, manufacturing and digital providers, and some entities regardless of size. Our scope check tells you whether you are an essential or an important entity.
How does NIS2 relate to ISO 27001?
ISO 27001 is a voluntary certification; NIS2 is law. An ISO 27001 management system covers much of NIS2’s Article 21 risk-management measures, but NIS2 adds its own duties, such as incident-reporting deadlines, management accountability and registration with national authorities. We map NIS2 onto your ISO 27001 controls so you only close the gaps.
