NIS2 cost and timeline depend on five drivers: scope and entity type, the gap from the required measures, supplier count, readiness to report incidents in 24 hours, and management approval. We give no prices, because none can be honestly derived without your facts.
What must you actually do?
Directive (EU) 2022/2555, Article 21(2), lists measures that essential and important entities must take, using an all-hazards approach. They cover risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling, ways to assess effectiveness, cyber hygiene and training, cryptography, human resources security, access control and asset management, and multi-factor or continuous authentication with secured communications.
Article 23 sets reporting stages: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, a final report no later than one month after the notification, and progress reports for ongoing incidents. Article 20 puts approval and oversight of the measures on the management body, which can be held liable, and requires its members to follow training.
Driver 1: scope and entity type
If you are out of scope, cost is a legal opinion. If you are in scope, your type matters. Article 34 sets maximum administrative fines of at least EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4 percent for important entities, whichever is higher, for infringing Articles 21 or 23. Member States implement the details, so national law can differ.
Driver 2: the gap from where you are
An organisation with an existing information security management system will find many measures already covered. One without will need policies, asset inventory, access control and incident handling built from scratch. A gap assessment against the ten measure areas is the cheapest way to turn this driver from a guess into a list.
Driver 3: supply chain scope
Article 21(3) asks entities to consider vulnerabilities of each direct supplier and their secure development procedures. The more suppliers you have, the more questionnaires, contract changes and evidence you will handle. Rank suppliers by criticality and start with the top tier. A software bill of materials from software suppliers and an inventory of your own dependencies make the secure development question easier to answer.
Driver 4: reporting readiness
Twenty-four hours is short. You need a way to decide what is significant, a named person who can file and a contact for the national authority or CSIRT. Building and testing that process takes weeks, mostly of elapsed time.
Driver 5: governance
Management approval and training require calendar time, not only effort. Book the sessions early.
How long does it take?
It depends on the drivers above, and we will not invent a number. A realistic sequence is scope determination, gap assessment, a prioritised plan, build, test and review. Elapsed time is usually dominated by supplier work and by waiting for decisions.
How is the rule changing?
The European Commission's NIS2 page notes that on 20 January 2026 the Commission proposed targeted amendments to simplify compliance. Check national law and the current text before you finalise a plan.
What to do
- Get a written scope view, including which national law applies to each entity in your group.
- Run a gap assessment against the Article 21(2) measure areas.
- Rank suppliers by criticality and plan requests for the top tier first.
- Draft and test an incident reporting process with 24 hour, 72 hour and one month stages.
- Schedule management approval and training.
- Review the plan again after you read any amended text.
Quick check
Can anyone tell me the cost before a gap assessment?
Not honestly. Cost depends on how far you are from the measures and on your supplier base.
Does a security tool make us NIS2 compliant?
No. Tools can help with inventory, vulnerability handling and evidence. Compliance is about your organisation, governance and national law.
Sources
Last reviewed: 18 October 2026.
