Every way companies process NIS2, priced side by side

There are ten ways to deal with NIS2, from free government checklists and Belgium's certified CyberFundamentals framework to a full consultancy project. Not sure NIS2 catches you at all? The free assessment answers that first, with nothing to sign. And one price below is different in kind: a ComplianceSME account is not a NIS2 product but the whole compliance estate, 116 EU and UK obligation registers with NIS2 among them. This page sets out what each one produces, what each one costs as published, and where ComplianceSME sits. Every figure is as published by its named source on 13 October 2026.

NIS2 demands real technical security, not only documentation. We produce the documentary and governance half from the instrument text with article citations at a published price: the Article 21(2) measures written down, the management body record Article 20 names, the registration details, the incident reporting procedure. The other half is engineering and it needs your engineers or a managed provider: multi-factor authentication deployed on remote access, logs of inbound and outbound traffic and of all privileged access maintained and reviewed, patch management in operation, penetration tests and vulnerability scanning run, backups held off the system's own network with restores tested, the vulnerability queue worked, the Article 23(4) early warning filed inside 24 hours into the right national portal at three in the morning, the Article 3(3) and 3(4) registration submitted, and an Article 32 inspection survived. Anyone selling NIS2 as fully solved by software is selling the same half we are.

We already have a NIS2 system. What is worth checking?

Start with registration. Articles 3(3) and 3(4) make registering with the competent authority a duty in its own right, and it was not mentioned on the NIS2 product pages of Vanta, Drata, Scytale, Secureframe, Hyperproof, OneTrust, ISMS.online, Diligent or LogicGate read on 13 October 2026. CyberSmart surveyed 670 in-scope business leaders across nine countries and found 16 per cent confident they are fully compliant, with 11 per cent unsure what NIS2 is despite being in scope.

What does Vanta or Drata cost for NIS2?

Neither publishes a price. Nor does Scytale, Secureframe, Sprinto, Hyperproof, ISMS.online, DataGuard, Copla, OneTrust, ServiceNow, Diligent, LogicGate or Archer, and none of EY, Deloitte, KPMG or PwC publishes a fee on its NIS2 readiness page. The two priced EU-native alternatives found were KOPEXA at 249 euros a month for Lite and 599 euros for Pro, and NIS2COMPASS at 29 euros a month for Pro. For scale, the German government's own estimate in Bundestag paper 20/9171 is 70,000 euros to set up and 30,000 euros a year to run, per affected entity.

Is there a cheaper alternative to Vanta or Drata for a small business?

For the documentation, yes. The 390 pounds a month all in buys the whole compliance account at the Medium level, 91 EU and UK obligation registers with NIS2 one of them. NIS2COMPASS at 29 euros a month for Pro is cheaper than both. What the automation platforms give you that we do not is continuous evidence collection from your connected cloud and identity tools.

Does Vanta cover NIS2?

It maps NIS 2 as one framework beside others, and its resources page publishes 50+ controls, 100+ policy templates, 600+ tests and 375+ integrations, with the claim that it "automates up to 65% of NIS 2 compliance workflows". Continuous testing answers the Article 21(2)(f) effectiveness assessment better than a design document does, as far as the connected estate reaches, so operational technology, industrial control systems and anything unwired sit outside it. Registration with the competent authority was not mentioned on the NIS2 product page read.

Is ENISA's free guidance enough for NIS2?

ENISA's technical implementation guidance, published 26 June 2025, sets out thirteen requirement areas with examples of evidence and mappings to standards, and it costs nothing. ENISA states that it is not legally binding and does not replace member state frameworks. Your duty sits in your national law, so the guidance tells you what the measures mean and your transposing act tells you what you owe.

Can a template pack make us NIS2 compliant?

A pack gives you documents to fill in. Advisera publishes 77 documents covering Articles 20, 21 and 23 and Implementing Regulation (EU) 2024/2690 with training for ten users, at 1,997 euros one-off or 90 euros a month; NIS2-Templates.com publishes 76 files at 497 euros complete, 249 euros quick-start, 997 euros enterprise and 199 euros a sector pack; GovernanceDocs publishes 78 templates at 99 dollars; IT Governance publishes 395 pounds for the first year and 100 pounds to renew. The blanks still have to be filled by someone who has read the Directive, and a filled template does not deploy multi-factor authentication.

What does an outsourced CISO cost for NIS2?

A7.DE publishes an external CISO from 1,500 euros a month plus VAT and its page answers the NIS2 question directly. HONICON publishes a gap analysis from 4,800 euros net one-off, ISMS operation from 1,380 euros net a month and certification preparation from 2,760 euros net a month, and notes independent auditor certification at 10,000 to 25,000 euros. FRSecure publishes 4,000 to 6,000 dollars a month and above, and Pivot Point Security 4,500 to 12,500 dollars a month, and NIS2 is not named on either of those pages. The pattern across this market is that providers who publish a retainer do not name NIS2, and providers who name NIS2 do not publish a retainer.

Do we have to register with anyone, and by when?

Yes, under Articles 3(3) and 3(4), and the clock is national. Germany's BSI portal opened on 6 January 2026 with a statutory deadline of 6 March 2026. Belgium's closed on 18 March 2025 for the non-digital sectors. Austria's NISG 2026 came into force on 1 October 2026 and requires registration by 31 December 2026. If nobody in the business has filed, the tool did not cover it.

Who files the 24-hour incident report?

You do. Article 23(4) runs an early warning within 24 hours, a notification within 72 hours and a final report within one month, and submission goes through the national CSIRT or competent authority portal, which differs by state. No vendor found claims to file it. A platform holds the draft and a named person on a rota presses send.

Our board has to be trained. Who does that?

Article 20(2) requires members of the management body to follow training and requires the entity to offer similar training to its employees. That training was not mentioned on the NIS2 product pages of the main platforms read, and it is sold separately across this market by specialist training providers. The ComplianceSME toolkit carries a training module holding the Directive itself, so the member of staff who runs the system learns the law first; the Article 20(2) duty names the management body, so the board's own training is a separate line to evidence.

We operate in Ireland, Spain or France. What law applies?

In October 2026 none of the three had a national NIS2 law in force. The Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026 with a request for a lump sum and daily penalties. Ireland's National Cyber Security Centre published a free guide, a scope tool and draft risk management guidance on 24 June 2025, and states that its portals are not available. One EU-wide control mapping does not tell you what to file there.

Can a director be held personally liable under NIS2?

Article 20(1) puts approval of the measures and oversight of their implementation on the management body and provides that its members can be held liable. For essential entities, Article 32(5)(b) lets a competent authority ask a court to bar a chief executive or legal representative from managerial functions temporarily, until the failure is remedied. Fines under Article 34(4) reach 10,000,000 euros or 2 per cent of total worldwide annual turnover, whichever is higher, and 7,000,000 euros or 1.4 per cent for important entities under Article 34(5). That is a board file, not a dashboard tile.

We have ISO 27001. Does that cover NIS2?

No certificate exists for NIS2. The Directive carries no attestation scheme, so nothing you hold proves compliance with it. Belgium's CyberFundamentals is the nearest thing, a national scheme published free and public by the Centre for Cybersecurity Belgium and built on NIST CSF 2.0, ISO 27001, CIS and IEC 62443, and it is free to self-assess. ISO 27001 is good evidence toward the Article 21(2) measures and it is a different document set from the one NIS2 names.

What is the cheapest way to get our NIS2 documentation?

Free first. The ComplianceSME assessment names whether NIS2 catches you and which sector and size tests do it, with no sign-in and nothing to pay, and ENISA's guidance, Germany's BSI scope check, the Centre for Cybersecurity Belgium's material and Ireland's NCSC guide cost nothing. Among the published prices found, GovernanceDocs is 99 dollars for 78 templates, NIS2COMPASS is 29 euros a month and the NIS2READY gap analysis report is 349 euros. The ComplianceSME NIS2 toolkit enters at the Medium level, 390 pounds a month all in, and produces the documentation with the article cited on every line.

We follow CyFun. Does that cover NIS2?

CyFun defines what an entity should do and can certify that it did it; it does not produce the documentation. Its published mapping covers the NIS2 Directive and the Belgian law, not Implementing Regulation (EU) 2024/2690, and it carries no standalone effectiveness assessment control at any level. An auditor asks for the risk register, the incident response plan, the supplier register and the management body record, and those documents are what our toolkit produces, with the article cited on every line. The strongest position uses both: CyFun as the framework to follow, the toolkit producing the evidence that it was followed.

What does ComplianceSME not do?

We do not deploy multi-factor authentication, we do not maintain or review your traffic and privileged access logs, we do not run patching, penetration testing or vulnerability scanning, we do not hold your backups or test your restores, and we do not file your Article 23 notification or your Article 3(4) registration. Those need your engineers or a managed provider. What we produce is the documentary and governance half, written from the Directive's own text with the article behind every line, kept current as the law moves.

Figures read 13 October 2026 from each provider's own published pages: Vanta's resources pages, Drata, Scytale, Sprinto, Secureframe, Hyperproof, ISMS.online, DataGuard, Copla, OneTrust, ServiceNow, Diligent, LogicGate, Archer, KOPEXA, NIS2COMPASS, Advisera, NIS2-Templates.com, GovernanceDocs, IT Governance, NIS2READY by Saevelis, HONICON, A7.DE, FRSecure, Pivot Point Security, and the NIS2 readiness pages of EY, Deloitte, KPMG and PwC. Law from Directive (EU) 2022/2555, Articles 3, 20, 21, 23, 32 and 34 and Annexes I and II, and Implementing Regulation (EU) 2024/2690. Official guidance from ENISA's technical implementation guidance of 26 June 2025, the BSI scope check and registration portal, the Centre for Cybersecurity Belgium's CyberFundamentals and Safeonweb@Work, Ireland's National Cyber Security Centre guide and scope tool of 24 June 2025 and France's ANSSI MonEspaceNIS2. Transposition and referral dates from the Commission's press release of 8 July 2026 and the national authorities. The estimate of 70,000 euros to set up and 30,000 euros a year is the German government's own, from Bundestag paper 20/9171. Survey figures from CyberSmart's NIS2 research of 2026, conducted by OnePoll among 670 in-scope business leaders in nine countries. Where this page states that a duty was not mentioned, that is what the product page read on 13 October 2026 carried. ComplianceSME prices and toolkit counts as published on the plans page. All trademarks belong to their owners. Corrections on evidence to toolkit@compliancesme.com.