NIS2 consultant cost and what they do

What a NIS2 consultant costs and what it covers

No EU source sets a price for NIS2 compliance per company, so a budget owner or customer asking for proof of readiness should not expect a published rate. The Commission's 2020 NIS2 proposal estimated that companies newly in scope would need to raise ICT security spending by up to 22% in the first years, and companies already under the first NIS Directive by 12% (COM(2020) 823). Those figures are a policy estimate for spending across the market, not a quote for your organization. Your actual cost depends on your scope and entity classification, the gap between your current controls and the Article 21 measures, and, if you are a digital provider, the extra duties in Implementing Regulation (EU) 2024/2690. The division of roles matters more than the price. Your organization owns its controls and remains accountable to its management body. A consultant or implementation partner prepares the measures, documentation and evidence, and can run the gap analysis and build the work plan. Only an independent auditor or an authorized body assesses compliance, and NIS2 creates no certificate that a vendor can issue. Ask any firm to state in writing which of these roles it performs and which it does not.

When you ask for a quote, require the scope to be written before the fee is set. Ask the firm to separate one-time work (scoping, gap analysis, policy and procedure drafting, control build-out, evidence set-up) from recurring work (annual reviews, supplier oversight, monitoring support, training, and any independent review that the authority may request). Targeted security audits carried out by an independent body at the authority's request are paid for by the entity under Articles 32(2) and 33(2), unless the authority decides otherwise, so ask how such costs would be estimated and who would pay. Two items drive cost more than any other: the number of systems and sites in scope, and how far your current evidence falls short of what an assessor will test. Confirm with the consultant how they will hand over the work so that your own staff can run it afterward, and whether the people reviewing your controls are independent of the teams they assess, as Implementing Regulation 2024/2690 expects where size allows.

Who is paid for what in a NIS2 engagement

This table separates the NIS2 cost components by who is paid for each one, whether the cost is one-time or recurring, and what moves it up or down. Read it before requesting quotes so that each proposal can be compared against the same list of components. The main takeaway is that the organization pays for its own management time and controls in every case, and that fees for outside work depend on scope and on the size of the gap to the Article 21 measures.

Cost component	Who is paid	One-time or recurring	What drives it up or down
Gap analysis and scoping	Consultant or implementation partner	One-time, with updates when scope changes	Number of entities and Member States, sector classification, and whether the entity is a digital provider covered by Implementing Regulation 2024/2690
Policy and measure build	Consultant, legal advisor or internal security team	One-time build, then recurring reviews	Number of Article 21 measures lacking documentation, and whether policies are tailored or taken from templates
Technical implementation	Implementation partner, cloud or hosting provider, software vendors	One-time setup, recurring operation	Existing tooling, system count, and how much hardening, logging and backup work is needed before evidence can be produced
Tooling and licenses	Software vendors or open-source support providers	Mostly recurring (licenses, subscriptions, support)	Choice between commercial and self-hosted open-source tools, and the number of users, endpoints or log sources
Internal staff time	The organization (salaries already in budget or new hires)	Recurring, often the largest ongoing share	Level of ownership kept in-house, number of control owners, and how well roles are documented
Independent reviews	The organization pays the independent reviewer	Recurring, usually at least annual for the review cycle	Size of the entity, whether reviewers are outside the reviewed line of authority, and whether alternative impartiality measures are used
Targeted security audits at the authority's request	The entity pays an independent body, unless the authority decides otherwise in duly substantiated cases	Occurs only when requested by the authority	Scope the authority sets, the findings, and how well evidence is already organized before the audit starts
Management body training	Training provider or internal program, paid by the organization	Recurring, as management body members must be trained	Whether training is delivered in-house or by an outside provider, and how many members must attend

How a NIS2 consultant engagement runs from scoping to evidence

The sequence turns an unclear NIS2 obligation into a documented set of measures, owned by the organization and backed by evidence a national authority can inspect. Each phase closes with a written output that the next phase depends on. Durations depend on the size of the entity, its environment and how much of the work already exists, so the engagement is scoped and timed in writing before it starts.

Confirm scope and entity classification
The consultant reviews the organization's sectors, services and group structure against Articles 2 and 3 of Directive (EU) 2022/2555 to establish whether NIS2 applies, whether the entity is essential or important, and which Member State has jurisdiction. Sector-specific laws that displace NIS2 are checked at the same time. The output is a short written classification memo that management reviews and signs off, because every later decision depends on it. The step is done when management accepts the classification and the in-scope services are listed by name.
Assess the gap against Article 21
The consultant compares the organization's existing policies, technical controls and processes with the ten minimum measures in Article 21(2) of NIS2. Digital providers in the categories covered by Implementing Regulation (EU) 2024/2690 also assess themselves against the 13 Annex sections of that regulation. Interviews, configuration reviews and document reviews produce the evidence for each finding. The output is a gap register that rates each requirement as met, partly met or missing, with the supporting evidence attached. The step is done when the register has been reviewed with the control owners.
Build the remediation plan
The consultant turns the gap register into a prioritized plan that lists each action, its owner, its dependencies and the evidence that will show it is complete. Items that management must decide, such as risk acceptance, budget and the appointment of security roles, are separated from technical work so they are not buried. The plan also notes which actions an implementation partner or service provider would carry out and which the organization must perform itself. The output is an approved remediation plan that management has accepted in writing.
Build measures and evidence
Engineers and the consultant implement the agreed measures, such as configuration hardening, logging, backup and access controls, and write or update the policies and procedures that describe them. Each measure is paired with an evidence artifact, for example a configuration export, a test record or a signed approval, stored where an authority could request it. Open-source and self-hosted tooling is often used to produce logs and records inside the organization's own infrastructure. The output is a control and evidence map that links each Article 21 requirement to the artifacts that prove it. The step is done when each artifact has been generated at least once.
Run an internal review
Someone who did not build the measures tests them against the evidence map and the gap register. Where the organization is small, the review uses alternative impartiality measures, as the implementing regulation allows where size does not permit full separation. The review confirms that controls work as described, that evidence is complete and that the policies match practice. Findings go back into the plan. The output is an internal review report with a list of open findings and their owners. An independent auditor or assessor, if one is engaged, is not part of this internal step.
Hand over to the organization
The consultant transfers the policies, evidence map, runbooks, configuration documentation and open findings to the named owners inside the organization. Staff are trained on the procedures they will run, and management receives a briefing on the status of the measures and the open risks it must accept or fund. Ongoing duties, such as periodic reviews, supplier oversight and incident exercises, are assigned in writing. The output is a handover pack and a signed handover record. The engagement is complete when the organization can operate and evidence the program without the consultant present.

What makes NIS2 consulting more or less expensive

Consultant fees follow the size of the job, not a fixed NIS2 price. The six drivers below decide how much work sits between your current controls and the Article 21 measures, and each one can be narrowed with scope decisions or evidence you already hold.

Sector and essential or important status

Your Annex I or Annex II sector and your classification set which supervision regime applies. Essential entities face ex ante supervision and important entities face ex post supervision, but both carry the same Article 21 and Article 23 duties, so the classification changes how much evidence a supervisor may request up front rather than the core work. Confirm your classification with your national competent authority or legal counsel before you scope the engagement, because a wrong starting point inflates or shrinks the work.

Number of entities and Member States

A group with several legal entities or operations in several Member States multiplies the gap assessments, policy adaptation and evidence collection, because each national transposition law applies on its own terms. Ask a consultant whether the quote covers one entity or the whole group, how shared policies will be reused, and which national requirements need separate mapping. Consolidating governance into one group framework usually lowers the repeat effort.

Systems and cloud estate

The number of networks, applications, identity stores, endpoints and cloud accounts in scope determines how many controls must be tested and how much logging must be proven. A narrowed scope that excludes systems with no bearing on the delivery of your services reduces both gap analysis and evidence work. Ask for an inventory of in-scope assets and a written rationale for each exclusion, since supervisors will test whether the boundary is credible.

Third-party and supplier dependencies

Each managed service, SaaS platform or outsourced operator you depend on adds supplier assessment, contract clauses and oversight evidence to the program. Organizations that already run a supplier register with security criteria and contract terms face much less rework than those starting from nothing. Confirm which suppliers already hold ISO 27001 or SOC 2 reports, because those reports can reduce the questions you must raise directly.

Current evidence maturity and existing frameworks

The largest variable in most quotes is how much of the required evidence already exists. If you hold a current ISO 27001 scope, a NIST CSF 2.0 profile or documented controls, a consultant can map them to Article 21 and reuse them, and ENISA's June 2025 guidance includes mappings to ISO/IEC 27001:2022 and NIST CSF 2.0 that can serve as a starting point. Treat those mappings as guidance to test against your own environment, not as proof that one framework satisfies the other. Ask the consultant to show which existing artifacts they will reuse and which they will rebuild.

Digital provider status under Implementing Regulation 2024/2690

If you are a DNS, TLD, cloud, data center, CDN, managed service, managed security service, online platform or trust service provider, you must assess yourself against the 13 Annex sections of Implementing Regulation 2024/2690. That adds technical and methodological requirements that most other entities do not carry, and it often drives the largest share of the work. Ask whether the quote covers the Annex sections that apply to your service type, and whether the independent review requirement in point 2.3.2 has been priced in.

Who owns, who prepares and who assesses

The management body owns NIS2 compliance. Under Article 20, it must approve and oversee the Article 21 risk-management measures, and it can be held liable for the entity's infringements of Article 21. Management cannot hand that accountability to a consultant, a vCISO or a provider. The internal team runs the program day to day: it decides risk acceptance, owns the asset inventory and business processes, and approves changes that affect the entity's operations.

Decisions that stay in-house: approving the risk-management measures, accepting residual risk, and setting the budget and priorities.
Governance duties: completing the cybersecurity training that Article 20 requires for management body members.
Operational ownership: asset and data inventories, business context, and sign-off on access rights and change approvals.
Incident decisions: deciding when an incident is significant and who speaks to the authority.
Commonly outsourced: drafting policies, gap analysis support and the technical work that a partner or provider can carry out.

Before engaging any outside party, confirm in writing which of these decisions remain with named internal roles and how management receives regular reporting.

Why writing policies is not the same as implementing controls

A policy states what the organization intends to do. It does not show that anything is running. Supervisors look for operating evidence: configured systems, retained logs, backups that have been restored in a test, staff who completed training, and records showing that someone reviewed the outcome. Article 20 makes this a management matter. The management body must approve the Article 21 risk-management measures and oversee their implementation, and it can be held liable for infringements of Article 21. A signed policy approved in a board meeting satisfies the approval step, but the oversight step needs regular reports from systems that actually produce data.

ENISA's June 2025 technical guidance on Implementing Regulation (EU) 2024/2690 gives examples of the evidence that assessors expect, which is a useful checklist for any consultant's work plan. Ask the consultant to map each policy to the artifact that proves the control operates: an access review export for an access control policy, a restore test log for a backup policy, a vulnerability scan report with remediation tickets for a patching policy. For each Article 21 area, the question to ask is what a supervisor could inspect on a Tuesday afternoon without waiting for the consultant to produce it. Note that the guidance is non-binding, and national frameworks determine how compliance is shown (see the ENISA guidance).

Warn buyers about consultants who deliver only documents. A package of policies, procedures and a risk register can be useful as a starting point, but it leaves the hardest work undone: configuring logging, enforcing multi-factor authentication, segmenting networks, rehearsing the 24-hour early warning, and training staff. Before signing, ask which controls will be configured in your environment, who will own each one after handover, and what evidence will exist at the end of the engagement. Confirm with the consultant that the deliverables include the systems and records, not only the text. Independent verification of the result remains the job of an authority-approved auditor or assessor, not the consultant.

Checks to run before hiring a NIS2 consultant

A NIS2 consultant can prepare your systems, policies and evidence, but cannot make your entity compliant on its own, and it cannot issue the assurance a supervisor may ask for. The checks below separate firms that can do the preparation work well from those that blur preparation and assessment. Use them to compare written proposals before any scope is agreed.

Sector and regulation experience

Ask for named examples of prior NIS2 work in your sector, and check that the firm has worked with the Article 21 measures and, if you are a digital provider, with the requirements of Implementing Regulation (EU) 2024/2690. Generic security experience is not the same thing. Ask how the firm mapped the Annex sections of the implementing regulation to your services, and ask to see the structure of that mapping before you sign. Do not accept client names or outcomes without written permission to share them.

Prepares or assesses, stated in writing

Ask the firm to state in its proposal whether it prepares your systems and evidence or whether it assesses them. A firm that prepares your controls should not also be the reviewer of those controls. The organization owns its controls and management decisions, the consultant prepares systems and evidence, and only an independent auditor or authorized body issues assessments. A proposal that promises an assurance report or a certificate from the consultant is a warning sign.

Independence from any assessment

If the same firm will later run or support an independent review, check the separation of roles. The implementing regulation requires that independent reviews be carried out by people with audit competence outside the line of authority of the area reviewed, or under alternative impartiality measures where size does not allow this. Ask who would perform the review, how that person is kept apart from the implementation team, and what the firm will do if it cannot meet that requirement.

Written fixed scope and deliverables

Require a written scope that lists the entity or entities covered, the services in scope, the Article 21 measures addressed, the deliverables and the acceptance criteria. Most engagements should be fixed-scope, with timelines agreed before work starts. Ask what happens when your scope changes, such as a new service or a new Member State, and how the change is priced and approved. Vague phrases like ongoing advisory without deliverables make it hard to judge what you bought.

Evidence samples and documentation ownership

Ask the firm to show sample evidence from comparable work, such as a redacted risk assessment, an access review record or an incident exercise report. Confirm in the contract that you own all policies, procedures, registers and evidence, in editable formats, and that you keep them when the engagement ends. Ask how evidence will be stored and who can access it. Without this, you may need to pay again to reproduce documents your supervisor asks for.

Named staff and national expectations

Ask for the names and roles of the people who will do the work, along with their security and audit qualifications, and confirm that the people in the proposal are the people who will deliver it. Ask the firm to confirm the expectations of the national competent authority in your Member State, because transposition laws differ, and to say how it will track changes to those expectations. Ask how it will handle the pending amendments proposed in January 2026, which still need approval.

Questions buyers ask about NIS2 consultants

How much does a NIS2 consultant cost?

No EU source sets a price for NIS2 compliance per company, so any quote you receive is a function of scope. The main drivers are how many entities and sites fall in scope, how far your current controls sit from the Article 21 measures, and whether you are a digital provider that must also meet Implementing Regulation (EU) 2024/2690. Consultant fees usually cover a gap analysis, a risk assessment, policy drafting and a remediation plan, while technology, staff time and any managed services are separate costs. Some costs are one-time, such as the initial gap analysis and build, and others recur, such as monitoring, training, annual reviews and retained support. The Commission's 2020 impact assessment estimated that newly in-scope companies would need to raise ICT security spending by up to 22% in the first years (COM(2020) 823), which is a sector-wide estimate, not a quote. Ask for a written scope, a list of deliverables, the assumptions behind effort, and which costs recur each year.

Can our internal team implement NIS2 without a consultant?

Yes, in principle. NIS2 does not require outside help, and the obligations fall on the entity and its management body. The question is whether your team has the time, the security skills and the independence to do the work. A capable internal team can usually run the scope analysis, the gap assessment and the policy set, provided someone with the authority to change processes sponsors the work. Where internal teams struggle is in evidence: proving that controls operate over time, testing incident response and reviewing their own work impartially. Article 21 and the implementing regulation expect independent reviews by people outside the line of authority of the area reviewed, or alternative impartiality measures where size does not allow this. Smaller organizations often combine internal ownership with an external reviewer. Decide which tasks you keep, which you buy and who signs off, before you hire anyone.

How long does NIS2 readiness take?

No authoritative source gives a fixed duration, and any number you hear should be treated as a guess until it is tied to your scope. Readiness depends on the number of entities and sites in scope, how many systems and suppliers must be assessed, how mature your existing security program is, and how much remediation the gap analysis reveals. Digital providers that must assess themselves against the thirteen sections of Implementing Regulation (EU) 2024/2690 face a longer path than most. Time is also consumed by approvals, change freezes, hiring and the period needed to show that controls operate, since evidence needs a track record. Ask any consultant for a phased plan with milestones, the assumptions behind each phase and the dependencies on your own teams, and check it against the national transposition law that applies to you.

Can a consultant certify that we are NIS2 compliant?

No. NIS2 creates no certificate of compliance, so no consultant can issue one, and a consultant should never sell you a NIS2 certificate. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. Depending on the national framework, ENISA's June 2025 guidance notes that compliance may be shown through assessment or certification by accredited conformity assessment bodies or by auditors authorized by national authorities. A consultant prepares your systems, policies and evidence, and an independent body performs any assessment that your national framework requires. Treat any claim of an official NIS2 certification as a warning sign and ask which authority or accredited body recognizes it.

Who pays for a security audit ordered by the authority?

The entity pays. Under Articles 32(2) and 33(2), the authority can order a targeted security audit carried out by an independent body, and the entity bears that cost, unless the authority decides otherwise in duly substantiated cases. This makes budget planning important: an audit ordered after an incident or a supervisory concern is a cost you cannot avoid by choosing a cheaper consultant. Keep your evidence current, including risk assessments, policies, logs and test results, so that an independent body can review them quickly and at a lower effort. Ask your consultant how the engagement would respond to an authority request, who would hold the evidence, and whether they can act as the entity's contact without becoming the independent auditor themselves.

What should our team provide before a consultant starts?

Before any consultant starts, your team should provide the information that makes a scope and a fair quote possible. Start with a list of legal entities, sites, sectors and services, plus any sector-specific laws that may apply. Add an asset and system inventory, network diagrams, the current policy set, recent risk assessments, incident records and a list of key suppliers with their contracts. Name a sponsor from the management body and a day-to-day owner who can make decisions. Confirm who will review the work independently and how management will receive training. A consultant can only estimate effort against what you can show them, so incomplete inputs usually mean a higher quote or a plan that changes later.

How DeployOpen scopes NIS2 work and prepares evidence

DeployOpen works on the technical side of NIS2 work: preparing systems, controls and evidence inside your own infrastructure for the consultant, auditor or authority that will review them. The organization keeps ownership of its controls and its management decisions, while we handle scoping, build, documentation and handover on written terms.

How we scope

Engagements are fixed-scope, with the systems, measures and deliverables agreed in writing before work starts.
We confirm which platforms and environments fall inside the written scope, including any cloud accounts, data centers or air-gapped networks.
Ask any provider for a written scope that names the Article 21 measures, systems and evidence it covers, and what it excludes.

How we build

We deploy and harden self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
Configuration, logging and access controls are built to produce the records a supervisor or independent reviewer will ask to see.
Security testing of applications, APIs, infrastructure and AI systems can be scoped as part of the build to check the controls work.

How we hand over

Systems, configurations and control documentation are delivered to your teams so they can run and explain them after handover.
Evidence packs are organized by control so your consultant or auditor can trace each measure to its records.
Gaps we find are listed in writing, with what remains for your management body to decide, accept or fund.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, agreed separately from the initial scope.
Backups, upgrades and documentation updates can be kept current as the platforms and your obligations change.
Confirm with your consultant or auditor which evidence they accept before we build it, since assessment routes depend on your national framework.

What a NIS2 consultant does and what it costs