What does NIS2 compliance cost, and what decides the number?
No EU source sets a per-company price for NIS2 compliance, so any budget you build will be your own estimate. The best public anchor is the Commission's 2020 proposal, COM(2020) 823, which estimated that companies newly in scope would need to raise ICT security spending by up to 22% in the first years, and companies already under the first NIS Directive by 12%. Those are percentages of existing security spend, not euro amounts, and they describe an average across very different organizations. Treat them as a sense check for your board paper, not as your number. The figure that matters to you depends on three things: whether your entity is in scope and classified as essential or important, the size of the gap between your current controls and the Article 21 measures, and whether you are a digital provider bound by the technical requirements of Implementing Regulation (EU) 2024/2690. Proportionality under Article 21(1) also works in your favor, because measures are weighed against your risk exposure, size and the cost of implementation. Ask your advisers to show how each cost line maps to a specific gap, and to separate one-time work (gap analysis, policy drafting, system hardening, evidence design) from recurring work (monitoring, training, testing, supplier reviews, reporting drills). Your organization owns its controls and the decisions behind them. An implementation partner can prepare systems, configurations and evidence, and a managed provider can run parts of the operation, but neither can certify compliance. NIS2 has no certificate, and any targeted security audit under Articles 32(2) or 33(2) is carried out by an independent body at the authority's request, typically paid for by the entity. Before you sign a quote, ask for a written scope, a list of deliverables, what evidence each deliverable produces, and which costs are excluded, such as audit fees and licences for tools you will keep running.
Who gets paid for what in a NIS2 program
This table compares each cost component of a NIS2 program by who is paid, whether the cost is one-time or recurring, and what drives it up. Read it before requesting quotes so you can see which lines your organization will carry internally and which it may buy from outside. No EU source sets a price per company, so ask each provider to itemize its quote against these rows.
| Cost component | Who is paid | One-time or recurring, and main cost driver |
|---|---|---|
| Gap assessment against the Article 21 measures | Consultant, implementation partner or auditor the entity engages; internal staff time if done in-house | One-time at the start, repeated when scope changes. Driver: number of in-scope systems and sites, and whether digital provider requirements under Implementing Regulation 2024/2690 apply. |
| Remediation and tooling | Software vendors or licensors, hardware suppliers, and any implementation partner doing the technical work | Mixed. Licenses and subscriptions recur; deployment is one-time. Driver: the size of the gap found and whether open-source platforms in the entity's own infrastructure replace paid products. |
| Implementation partner work | Implementation partner, paid under a written, fixed-scope agreement | One-time for build and hardening; optional recurring retainer for upgrades and support. Driver: scope agreed in writing, number of platforms and the evidence the entity needs to produce. |
| Internal staff time | Entity's own employees (salaries are an internal cost, not an invoice) | Recurring. Driver: how many people own policies, evidence collection, reporting drills and supplier reviews, and whether those duties are shared or single-person. |
| Targeted security audits ordered by the authority | The entity pays the independent body that carries out the audit, unless the authority decides otherwise in duly substantiated cases (Articles 32(2) and 33(2)) | Event-driven, not budgeted in advance by default. Driver: the scope the authority sets and the readiness of documented evidence. Ask providers how they support audit preparation. |
| Managed monitoring | Managed security service provider or managed SOC, or the entity's own security operations staff | Recurring. Driver: hours of coverage, log volume, and whether the provider also supports the reporting deadlines of Article 23. |
| Training for management body members | Training provider, internal trainers, or the entity's own program | Recurring as refreshers are needed. Driver: number of management body members and whether training is tailored to the entity's risk profile. Confirm the required format with your national authority. |
What makes NIS2 cost more or less
NIS2 has no price list, so the cost of compliance follows from a handful of drivers. Article 21(1) ties the measures to proportionality, which means the same obligations can cost very different amounts depending on the entity, its footprint and the evidence it already produces.
Entity size and sector
Article 21(1) requires measures that take account of the state of the art, implementation cost, risk exposure, size, and the likelihood and severity of incidents. A large entity in an Annex I sector usually faces a higher risk profile and more measures to document than a small one in an Annex II sector. Check which sector and entity classification applies to you first, because it sets the baseline the proportionality test starts from. Ask advisers to show how their scope assumption affects the work.
Number of systems and locations
Every in-scope system, network segment and site adds asset inventory, access reviews, patching records, backup tests and logging to the program. Multi-site groups also need to decide which controls are central and which are local. Before quoting, count the systems that process or support the in-scope services, list the locations and identify which ones already run on a shared platform. A written asset inventory is the cheapest way to reduce uncertainty in the quote.
Existing ISO 27001 or similar controls
An operating management system for information security can cut the cost of NIS2 because many Article 21 measures overlap with it. ENISA's technical implementation guidance includes a mapping to ISO/IEC 27001:2022 and NIST CSF 2.0 and is free to use, which helps entities reuse existing controls and evidence. The savings come from reuse, not from skipping gaps. Ask a prospective partner which existing controls they will map and which Article 21 duties still need new work.
Third-party and supplier dependencies
Managed service providers, cloud hosts, software vendors and contractors who touch in-scope systems extend the work in two directions. You need to assess their security, write the contract clauses that pass requirements down, and keep records of those assessments. Entities that already run self-hosted platforms in their own environment have fewer external dependencies to assess, but must still document each one. Inventory every supplier that can affect an in-scope service before requesting quotes.
Evidence maturity
Supervisors judge compliance on evidence, and the cost of producing it depends on how much already exists. Policies that are approved, dated and reviewed, logs that are retained and searchable, and test records from past exercises shorten the gap analysis considerably. Where evidence is missing or assembled by hand each time, budget more for tooling, documentation and staff time. Ask a provider to show the evidence it will produce for each measure, and who will keep it current.
Digital provider status under 2024/2690
Entities covered by Implementing Regulation (EU) 2024/2690, including DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers, face technical and methodological requirements that are more detailed than the general Article 21 measures. That raises the work and the audit scope. Confirm early whether your activity falls under the regulation, because the difference changes the gap analysis and the evidence you must hold.
What the Commission's estimates say and what they do not
The Commission's impact figures for NIS2 come from its 2020 proposal, COM(2020) 823, and they are estimates made before the Directive was adopted. The Commission estimated that companies newly brought into scope would need to raise their ICT security spending by up to 22% in the first years, and that companies already covered by the first NIS Directive would need to raise it by 12%. Those percentages describe a sector-wide average expectation. They do not tell an individual entity what its own budget will be, because the increase depends on how far its current controls sit from the Article 21 measures. Before using either figure in a board paper, confirm which baseline your organization falls under and compare it with your own security spending for the past two or three years.
The same proposal expected that higher spending would be offset by fewer costly cybersecurity incidents. The Commission put the avoided incident cost at EUR 118 billion over ten years. This is an expectation of the proposal's authors, not a guarantee and not a saving any organization can count on. The offset depends on whether entities actually reduce incident frequency and severity, which no one can measure in advance. It also rests on assumptions about the threat environment in 2020. Treat the EUR 118 billion as a policy rationale. If your business case uses an offset, build it from your own incident history, insurance data and recovery costs, and state the assumptions openly.
The Commission also estimated that national competent authorities would need about 20 to 30% more resources in the short and medium term. That figure concerns regulators, not entities, so it does not add a line to your invoice. It does matter to you indirectly, because it signals how much supervisory activity to expect, including security audits and information requests. Where an authority orders a targeted security audit, the entity pays for it unless the authority decides otherwise in duly substantiated cases (Articles 32(2) and 33(2) of NIS2). Ask your national authority how it plans to fund and schedule such audits, and budget for at least one unplanned external review in your multi-year plan.
What non-compliance can cost
Article 34 of NIS2 sets the maximum administrative fine for essential entities at a minimum of EUR 10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. The ceiling is a maximum set by the Directive, not a fixed amount that every infringement attracts. Authorities choose a fine within the range their national law allows, and the turnover-based figure means that large groups face the higher number.
- Fixed floor: The EUR 10 million figure applies as a minimum maximum, so national law may set higher ceilings.
- Turnover test: For a group with large revenue, 2% of worldwide turnover is the figure that usually exceeds the floor.
- Ex ante supervision: Essential entities face proactive checks, including inspections, security audits and security scans, before a problem surfaces.
- Enforcement steps: Measures can escalate to orders to bring practices into line, instructions and, in serious cases, temporary suspension of certain activities.
- Management exposure: Article 20 makes management body members accountable for approving and overseeing the Article 21 measures.
Before you rely on these numbers, confirm with counsel the exact ceiling, the turnover reference period and the enforcement powers in your Member State's transposition law.
For important entities, Article 34 sets a lower maximum of at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher. The obligations are the same as for essential entities, including the Article 21 measures and the Article 23 reporting timelines. The difference lies in how supervision works, since authorities act ex post, usually after they receive evidence of a failure, a report or a complaint.
- Lower ceiling: The floor and percentage are lower than for essential entities, but the same turnover test applies.
- Reactive supervision: Authorities can still request information and order security audits when they have indications of non-compliance.
- Same duties: A missed 24-hour early warning or 72-hour notification carries the same legal weight as for essential entities.
- Classification risk: An entity that misjudges its status may face a higher ceiling than it planned for, so the classification should be documented.
- Audit costs: Entities pay for targeted security audits ordered by the authority, unless the authority decides otherwise in duly substantiated cases.
Ask your legal team to confirm how your national authority applies ex post supervision and whether it publishes an enforcement policy.
The Article 34 figures are maximums that the Directive requires Member States to reflect in their national laws. They are not a schedule of fines, and the actual regime depends on the transposition law, the competent authority's practice and the facts of each case. Because the Directive is transposed country by country, the penalty framework an entity faces is set by the Member State where it is under jurisdiction.
- Transposition sets the rules: The amount and procedure follow from the national law that implements NIS2 in each jurisdiction.
- Fines and other measures: Authorities can combine fines with binding instructions, audits and public statements, so fines are not the only cost.
- GDPR can apply to the same incident: A personal data breach can trigger GDPR fines and NIS2 sanctions in parallel, each under its own rules.
- Parallel proceedings: Reporting to a NIS2 authority does not discharge GDPR notification duties, and the two regimes can open separate files.
- Indirect costs: Remediation, legal fees, contract disputes and loss of customer trust sit outside the fine figures.
Document which authority supervises you, what your national law states and how incident reports will be coordinated across both regimes before an incident occurs.
How the January 2026 proposal could change the bill
On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. The Commission says the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and lower compliance costs for 22,500 companies through the new category. These figures are the Commission's own estimates of the proposal's effect. The proposal still needs approval by the European Parliament and the Council, and it may change before it is adopted, so no budget should assume it. Budgets should be built on the national transposition law that applies to the entity today, with the Article 21 measures and their cost drivers as they stand.
The second proposal sits in the Digital Omnibus, dated 19 November 2025, which would create a single-entry point for incident reporting. The Commission says it would cut reporting effort in half for most organizations. That is a Commission claim about a proposal, not a measured saving. Until the single-entry point exists in law and in a national system, the 24-hour, 72-hour and one-month reporting steps still apply, and the reporting workflow, staffing and tooling costs stay in the current budget. Ask your national competent authority and your managed security provider whether any reporting tooling you buy now can be reused if the single-entry point arrives, and which contract terms would apply if it does not.
For planning, treat the proposal as a scenario rather than a saving. Ask your advisers to price the current obligations in full, then list which lines would fall away or shrink under the mid-cap category or a single reporting point, and confirm your size category against the text as adopted. The current status of COM(2026) 13 is best checked on the Commission's own page for the proposal, which records the stage it has reached in the legislative process.
How a NIS2 cost estimate is built
The sequence turns an unknown compliance bill into a costed plan by fixing the scope first, then the gaps against Article 21 and, where relevant, Implementing Regulation 2024/2690, and only then the work and the price.
Confirm the scope before pricing anything
Start from the scope check: sector and entity type under Annexes I and II, the size-cap rule, whether the entity is essential or important, which Member State supervises it, and whether a sector-specific law such as DORA displaces parts of NIS2. The organization owns this decision and should record it with its legal or compliance team. The output is a written scope statement listing the entity, the in-scope services and systems, the sites and the supervisory authority. Do not request a quote until this statement exists, because a cost for an undefined perimeter cannot be compared with another.
Map existing controls to the Article 21 measures
Inventory the security controls, policies, tooling and evidence the organization already has, then compare them against the ten minimum measures in Article 21(2). Where the entity is a digital provider in scope of Implementing Regulation 2024/2690, add the requirements of that regulation for its service type. ENISA's June 2025 guidance, which is free to use, gives examples of evidence and mappings to ISO/IEC 27001:2022 and NIST CSF 2.0 that help reuse existing work. Your gap analysis team or partner performs this mapping, but management must confirm the results. The output is a gap register: each requirement, the current state, the evidence available, and the size of the gap.
Rate each gap by risk and proportionality
Article 21(1) ties the measures to the state of the art, relevant standards, implementation cost, risk exposure, size, and the likelihood and severity of incidents. Use these factors to rank the gaps, so that the high-exposure items are costed first and low-exposure items can be scheduled or accepted with a documented rationale. The organization decides risk acceptance; the partner documents the reasoning. The output is a prioritized gap register with a rating and an owner for each gap. This step is where cost estimates diverge most, so ask any bidder to show how its ranking was made.
Build the remediation plan with cost drivers
Group the prioritized gaps into work packages such as policy writing, identity and access changes, logging and monitoring, backup and recovery, supplier management, and training for the management body. For each package, separate one-time work (design, configuration, documentation, first-time testing) from recurring work (licenses, monitoring, evidence collection, audits, staff time). Record the assumptions that move the price, including system count, number of sites, existing tooling, and whether self-hosted open-source platforms are used inside the client's own environment. The output is a costed remediation plan that names who performs each item: internal staff, an implementation partner, a consultant, or a managed service.
Account for audits and supervision costs
Add the costs that fall on the entity regardless of its internal work. NIS2 creates no certificate, but authorities can order targeted security audits carried out by an independent body, and under Articles 32(2) and 33(2) the entity pays for them unless the authority decides otherwise in duly substantiated cases. Include the time staff spend on information requests and inspections. An independent auditor issues any report or certificate; a partner prepares the evidence. The output is a line item for expected supervisory and audit exposure, with the assumption stated, so the plan does not treat audits as free.
Write the partner scope and request a quote
Convert the costed plan into a written scope that lists deliverables, systems in and out of scope, evidence to be produced, assumptions, client responsibilities and acceptance criteria. Ask each bidder to price against the same statement so the quotes are comparable. Ask whether the quote covers one-time work, recurring support, and third-party licenses, and how changes to scope are priced. DeployOpen works from a written scope and does not publish a price list, so a quote follows from this document. The output is a fixed-scope agreement signed before work starts, which sets the deliverables, timelines and responsibilities in writing.
What to have ready before asking for quotes
A NIS2 cost quote is only as accurate as the scope behind it. The six items below are the inputs an implementation partner or consultant will ask for first, and each one changes the size of the gap to the Article 21 measures.
Confirmed sector and entity type
Know whether you sit in an Annex I or Annex II sector and whether you are classified as essential or important. Essential entities face ex ante supervision and important entities face ex post supervision, so the same control set can carry different evidence and audit expectations. Confirm the classification with your national competent authority or your legal team before you request quotes, because a scope assumption that changes later can reopen the whole estimate.
In-scope systems and locations
List the networks, applications, cloud accounts, data centers and sites that support your in-scope services, including those in other Member States. Cost rises with the number of systems that need logging, access control, backup testing and patch evidence. Mark which systems are shared with out-of-scope business units, since shared components often decide whether a control is cheap to extend or costly to rebuild.
Existing policies and risk assessment
Gather your current information security policies, asset inventory and most recent risk assessment, with dates and owners. Article 21(1) ties required measures to proportionality, so a documented risk assessment is what justifies the measures you pick and the spend you plan. Missing or outdated documents usually add drafting and review effort to the quote, and a partner will price that work separately from technical remediation.
Current ISO 27001 or control evidence
Collect any ISO/IEC 27001:2022 certificate, statement of applicability, internal audit reports, penetration test results and access review records. ENISA's technical guidance and its mapping to ISO/IEC 27001:2022 are free to use, so existing controls can often be reused as NIS2 evidence. Ask the partner to state which controls they will map directly and which they will still need to build, because reuse reduces the remediation line of the quote.
Supplier list and critical dependencies
Prepare a register of suppliers that host, operate or access your in-scope systems, including managed service providers and cloud platforms. Note which contracts already contain security clauses, incident notification terms and audit rights. Suppliers without these terms add contract negotiation and due diligence work, which is often one of the less visible cost lines in a NIS2 program.
Named management body sponsor
Name the member of the management body who approves the Article 21 measures and oversees their implementation, as Article 20 requires. The sponsor decides budget, accepts residual risk and attends the mandatory cybersecurity training. Without a named sponsor, quotes stall at approval stages and remediation priorities cannot be set, so confirm the person, their decision rights and the budget ceiling before engaging a partner.
Who pays for what: your team, a partner and the auditor
The organization owns its NIS2 compliance. That means its management body, security function and process owners make the decisions, accept the residual risk and run the controls day to day. Internal cost is mostly staff time and recurring operating effort, and it is often the largest share of spending because it continues after any project ends.
- Management accountability: Under Article 20, the management body must approve and oversee the Article 21 measures and can be held liable for infringements. This accountability cannot be transferred to a consultant or vendor.
- Policy and risk ownership: Staff write, approve and review the risk assessment, policies and asset inventory, and they decide which risks are accepted.
- Daily operation: Access reviews, patching, backups, vulnerability handling and incident triage run as recurring tasks that someone inside the organization must perform and record.
- Evidence production: Logs, tickets, meeting minutes and test results must be kept in a form a supervisor can inspect.
- Training time: Management body members must complete the cybersecurity training that Article 20 requires, and staff need role-based training.
Before accepting any quote, ask which of these tasks the vendor will perform and which must remain with your staff, and confirm how many hours of internal time the plan assumes.
An implementation partner such as DeployOpen works on the entity's systems and documents, typically under a fixed-scope written agreement. The partner prepares systems, controls and evidence so the organization can show compliance. It does not decide the entity's risk appetite, does not sign off the entity's compliance, and does not issue any report, attestation or certificate.
- Systems work: Planning, building, hardening, integrating, backing up and documenting self-hosted open-source platforms inside the client's own infrastructure.
- Control and evidence preparation: Configuring logging, access controls and monitoring so that the evidence a supervisor may request exists and is retrievable.
- Security testing: Application, infrastructure and cloud testing that the entity may commission to check its controls, with findings handed back to the entity for remediation.
- Documentation and handover: Runbooks, configuration records and training so internal staff can operate the systems after the engagement.
- Ongoing support: Upgrades, testing and support are available as retainers, a recurring cost separate from the initial scope.
Ask for the written scope, deliverables and timeline before work starts, and confirm which deliverables are the partner's and which remain the entity's.
An independent auditor, assessor or certification body tests the entity's controls and issues any formal report or certificate. NIS2 creates no certificate of compliance. Instead, national competent authorities oversee compliance through inspections, information requests, security audits and security scans. Where an authority orders a targeted security audit, the entity pays for it, carried out by an independent body, unless the authority decides otherwise in duly substantiated cases (Articles 32(2) and 33(2)).
- Independence: The auditor must not design or implement the controls it tests, so it cannot be the same firm that prepared the systems.
- No NIS2 certificate: Any offer to issue a NIS2 certificate should be treated with caution. Ask which standard, scheme or authority the offer relies on.
- Voluntary assessments: An entity may commission an assessment against a standard such as ISO/IEC 27001:2022, which yields a report from an accredited body that the entity can share with customers and supervisors.
- Authority-ordered audits: Costs fall on the entity when a competent authority requires an independent audit, so budget for this contingency.
- Scope and fees: Auditor costs depend on scope and sampling, so request a written fee basis.
Confirm the auditor's accreditation and independence before engaging it, and check whether the audit is voluntary or ordered by an authority.
What inflates NIS2 budgets and how to avoid it
Most overspend on NIS2 comes from a small set of decisions made early: how scope is read, which proposals are budgeted as law, and who is paid for what. The cards below cover the common causes, each with one check to run before money is committed.
Unclear scope drives the budget
Budgets built before the entity is confirmed in scope tend to cover the wrong sectors, the wrong entity classification or the wrong group of companies. Essential and important entities face the same Article 21 and Article 23 duties, but supervision differs, so the classification changes how much evidence must be ready and when. Check the sector in Annex I or II, the size-cap rule, any sector-specific law that displaces NIS2, and the Member State with jurisdiction before requesting a quote. Ask the consultant to state the scope assumptions in writing.
Budgeting for proposals as law
The 20 January 2026 proposal (COM(2026) 13) would add a small mid-cap category and ease some obligations, but it is not yet law and needs approval by the European Parliament and the Council. Planning spend around the proposed relief can leave gaps if the current text applies when the program is due. Build the baseline on the Directive and the national transposition law that applies to your entity, then treat any proposed relief as an upside to review once it is adopted. Confirm the status of the proposal before each budget cycle.
Buying a NIS2 certificate
NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. A vendor selling a NIS2 certificate is selling something the law does not provide, and the spend does not satisfy an authority. Ask what the deliverable is, who issues it, and how it maps to evidence an authority can test. Standards such as ISO/IEC 27001:2022 can support the evidence file, but a certification to a standard is not a NIS2 certificate.
Skipping supplier and reporting work
Programs often concentrate budget on technical controls and leave the supplier clauses and incident reporting process unfunded. Article 23 requires staged reporting, with an early warning, a notification and a final report, so the process needs tested people, tools and contacts, not only a policy. Supplier assessments and contract clauses also take time to negotiate across the supply chain. Before approving the budget, list the supplier contracts that need security terms and the reporting roles that must be staffed and exercised, then cost them as separate lines.
Paying for duplicated controls
Entities that already hold an ISO/IEC 27001:2022 certificate, a SOC 2 report or a DORA program can end up buying the same controls twice under different names. ENISA's technical implementation guidance, published 26 June 2025, includes examples of evidence and mappings to ISO/IEC 27001:2022 and NIST CSF 2.0, and it is free to use under CC BY 4.0. Map existing controls to the Article 21 measures first, then fund only the gaps. Ask the provider to show which existing evidence it reuses and which items are new.
Late authority-ordered audits
Under Articles 32 and 33, competent authorities can order targeted security audits carried out by an independent body, and the entity pays unless the authority decides otherwise in duly substantiated cases. An audit ordered without warning can land on a budget that never reserved money for it, and remediation findings can then be rushed at premium rates. Keep an audit reserve in the plan, keep evidence current so an audit does not start from zero, and ask any consultant to estimate remediation effort for the findings most likely in your sector.
NIS2 cost questions buyers ask
Is there a fixed price for NIS2 compliance?
No. No EU source sets a price for NIS2 compliance per company, so any fixed figure you see is someone's estimate for their own situation. The cost depends on three things: whether your entity is in scope and how far your current controls sit from the Article 21 measures, your size and risk exposure, and, for digital providers, the extra requirements of Implementing Regulation (EU) 2024/2690. Cost also splits into one-time work, such as the gap analysis, policies, and system changes, and recurring work, such as monitoring, testing, training, and supplier reviews. Ask any provider for a quote built from a written scope that lists these items separately.
Who pays for an audit ordered by the authority?
Your organization pays. Under NIS2, entities bear the cost of targeted security audits carried out by an independent body when the competent authority requests them, unless the authority decides otherwise in duly substantiated cases (Articles 32(2) and 33(2)). Budget for this as a possible recurring exposure, separate from your internal program. Your contracts with auditors should state who selects the body, how scope is set, and how invoices are split. Keep your evidence current so an audit takes less preparation time and less billable effort.
Can we buy a NIS2 certificate to prove compliance?
No. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines (Articles 32 to 34). What you can buy is preparation: a gap analysis, documented policies, technical evidence, and support during an audit. Any vendor offering a NIS2 certificate should be treated with caution until you have checked what the document actually proves and whether an authority recognizes it. Ask for the scope and the independent body behind any attestation you are asked to pay for.
What does the Commission's 22% spending estimate mean for us?
It is a 2020 estimate for the whole EU, not a budget for your company. In its NIS2 proposal, the Commission estimated that companies newly in scope would need to raise ICT security spending by up to 22% in the first years, and companies already under the first NIS Directive by 12% (COM(2020) 823). The Commission expected this to be offset by a considerable reduction in the cost of incidents, which it estimated at EUR 118 billion over ten years. Use the figure as a sense check against your current ICT security budget, then build your own estimate from your gap to the Article 21 measures. Your baseline matters more than the average.
Can our own team run NIS2 compliance in-house?
Often yes, for parts of it, but management must keep ownership. Article 20 places approval and oversight of the Article 21 measures with the management body, which also carries liability for infringements, and members must follow training. Your team can run the gap analysis, policies, and technical controls if it has the skills and time. Consider outsourcing specific pieces where you lack depth, such as an independent gap review, technical hardening, evidence collection tooling, or audit preparation. An implementation partner prepares systems and evidence, but only an independent auditor or authority issues findings. Ask any partner to confirm which tasks it performs and which remain yours.
What should a NIS2 quote include?
A quote should follow from a written scope, not a rate card. Ask for:
- The entity type, sector, and systems in scope, with any digital provider requirements from Implementing Regulation (EU) 2024/2690 listed separately
- Deliverables for the gap analysis, policies, technical changes, and evidence collection
- Which items are one-time and which recur, such as monitoring, testing, upgrades, and training
- Assumptions about your existing controls, staff effort, and client responsibilities
- Exclusions, including audits ordered by the authority, legal advice, and vendor licenses
- Acceptance criteria and a timeline agreed before work starts
A quote that cannot name its assumptions is hard to compare with another.
How do the pending NIS2 proposals change our budget?
Do not budget for them as settled law yet. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The Commission says the proposal would ease compliance for 28,700 companies, including 6,200 micro and small enterprises, and lower costs for 22,500 companies through the mid-cap category. It also proposes a single-entry point for incident reporting, which the Commission says would cut reporting effort in half for most organizations. Both still need approval by the European Parliament and the Council. Plan for the current rules, keep reporting processes flexible, and reassess once the text is adopted and your national law is clear.
Does ISO 27001 reduce our NIS2 cost?
It can reduce effort, but it does not replace NIS2 obligations. ENISA's technical implementation guidance for Implementing Regulation 2024/2690 includes examples of evidence and a mapping to ISO/IEC 27001:2022, and the guidance is free to use under CC BY 4.0. If you already run an ISO/IEC 27001 management system, you can reuse many controls, policies, and records. You still need to cover the legal duties that ISO does not address, such as the reporting deadlines in Article 23 and management body accountability. Confirm the overlap with your auditor and ask your provider to show the mapping for your own controls.
How DeployOpen scopes NIS2 work for a fixed quote
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, whether that is their cloud accounts, data centers or air-gapped networks. Where a NIS2 program needs systems and evidence prepared, that work is scoped in writing before anything starts. The written scope is the basis of the quote, so the first step is agreeing which platforms, Article 21 measures and evidence sets are in and out of the engagement, and who on the client side owns each decision.
A useful scope names the concrete items: which systems are being hardened or configured, which logging, backup and access settings must be captured, which policies and runbooks must be written, and which evidence the client expects to hand to its assessor or competent authority. If the entity is a digital provider subject to Implementing Regulation (EU) 2024/2690, the scope should also say which sections of that regulation are covered. Ask for the deliverables, the acceptance criteria for each one, and the client responsibilities, such as access, approvals and staff time, written out so the quote can be compared with other offers.
DeployOpen does not publish a price list. A quote follows from the written scope, and retainers are available for ongoing support, upgrades and continuous testing once the one-time work is complete. DeployOpen does not issue audit reports, attestations or certificates. NIS2 creates no certificate, and any assessment of the client's compliance is performed by the competent authority or an independent body that the authority engages. Confirm with the authority and your legal counsel which assessor applies to your entity before you buy any preparation work.
