The EU's Network and Information Security Directive (EU 2022/2555) sets legal cyber security and incident reporting duties for essential and important organisations - and reaches UK businesses that operate in, or supply into, the EU.
Every client we have taken through an accreditation has achieved it - and kept it at every renewal.
We submit ourselves to independent third-party testing. Certification is always issued by an independent body, never by us.
We prove each control works on your real devices and services. Questionnaire answers can be inaccurate or optimistic; tests cannot.
We will look at your current position for free and tell you exactly which controls you need - with no obligation.
NIS2 replaced the original NIS Directive and has applied across EU member states since October 2024. It widens the sectors covered - from energy, transport, health and digital infrastructure to manufacturing, food, waste, postal services and managed IT providers - and makes senior management accountable for cyber risk.
In the UK, the NIS Regulations 2018 still apply and the government's Cyber Security and Resilience Bill is set to extend them to more organisations, including managed service providers. If you trade in the EU or supply organisations that are in scope, their NIS2 obligations will flow down to you through contracts.
Documented risk analysis and information security policies, owned by management.
The ability to detect incidents and report significant ones: an early warning within 24 hours, a notification within 72 hours and a final report within a month.
Backups, disaster recovery and crisis management that are tested, not assumed.
Security requirements for, and assessment of, your key suppliers.
Vulnerability handling and disclosure across the systems you build or run.
Basic hygiene, staff training, multi-factor authentication, access control, asset management and appropriate cryptography.
We review your devices, cloud services and processes against NIS2 and show you where you stand.
We fix or guide you through every control that would fail, in priority order.
We prove each control works - scans, patch checks, malware tests, restores and MFA checks - before anyone else looks.
An independent assessor, auditor or certification body confirms it. We never certify our own work.
We monitor your controls in real time and fix drift as it happens, so renewal is a normal day, not a cliff edge.
Our own intellectual property is how we run compliance: we monitor the major NIS2 controls in real time using the leading enterprise SaaS tools. That lets us map gaps and bridge controls quickly and accurately while you work towards accreditation - and then keep standards up, and risk down, every day after it.
We watch the major controls continuously using leading enterprise SaaS security and compliance tools - not once a year with a questionnaire.
Live data shows exactly which controls are missing or drifting, so we can map the gaps and bridge them quickly and accurately.
Every change to your systems follows a compliant change process, so an upgrade or a new starter never quietly breaks a control.
Issues are picked up and fixed as they happen. Your risk goes down over the year instead of creeping up until the next audit.
Annual review is not viable in the current threat landscape. Attackers do not wait twelve months - so neither do we.
Certification is a snapshot. Our compliance plans keep the controls tested, the evidence current and renewals handled - Level 1 demonstrates, Level 2 practises and Level 3 proves compliance continuously.
CE and Digital GDPR Controls - Our consultants will complete the CE submission with input from your staff.
CE, CE+ and Digital GDPR Controls -Monitoring & Submission as a Service (Submission following Quarter)
CE, CE+, GDPR Governance, Supply Chain Audits, Pen Testing, Vulnerability Scanning, (Real-time Maintained) Compliance As A Service
Not directly in the UK, but it applies to your EU operations and it is increasingly written into contracts by EU customers. The UK is also strengthening its own NIS Regulations along similar lines.
Member states can fine essential entities up to €10m or 2% of global turnover, and important entities up to €7m or 1.4%, with personal accountability for management.
With our free assessment: we map the NIS2 measures against how you work today and give you a prioritised gap list.
Yes - it covers much of the cyber hygiene baseline. NIS2 goes further on governance, incident reporting, continuity and supply chain, which our Level 2 and 3 plans address.
We monitor the major controls in real time using leading enterprise SaaS tools, with compliant change management behind every change. Gaps are found and bridged quickly, standards are maintained every day, and accreditation stops being a fraught cliff edge - you can say you were compliant yesterday, not a year ago.
Controls drift: devices miss patches, accounts change, new services appear. With an annual review that drift goes unnoticed for months while risk rises. Real-time monitoring catches it as it happens, so issues are fixed quickly and your compliance improves rather than decays.
Book a free, no-obligation NIS2 assessment. We will show you which controls you already meet, which you need, and the quickest route to getting certified.
