NIS 2 Directive - HanaByte

NIS 2 is the European Union’s updated Network and Information Security directive, broadening the original NIS rules to far more “essential” and “important” entities across critical sectors. It mandates baseline cybersecurity risk-management measures, holds management personally accountable for oversight, and sets strict timelines for reporting significant incidents to national authorities.

HanaByte helps organizations that operate in or sell into the EU interpret NIS 2’s obligations, map them to controls they may already run (such as ISO 27001 or NIST CSF), and put the governance and incident-reporting processes in place ahead of national enforcement deadlines.

How we help

NIS 2 Workshops

Scope

Interactive workshops on NIS 2 processes and requirements, educating key stakeholders, technical personnel, and support teams. Sessions are used to learn more about your business.

Deliverables

Delivery of workshops covering NIS 2 requirements and authorization paths.
Regular remote meetings to track progress on a schedule that fits your team.

Personnel & timeline

Security consultant(s) assigned to the engagement for a flat fee.

Customer responsibilities

Provide access to related documentation and in-scope systems.
Provide access to relevant personnel for workshop sessions.

NIS 2 Advisory Services

Scope

Guidance assessing your existing control implementations, infrastructure, policies, procedures, and documentation against NIS 2 requirements.
Ongoing guidance through NIS 2 requirements and which priorities to address first.

Deliverables

Regular meetings to consult on NIS 2 processes and close compliance gaps.

Personnel & timeline

Security consultant(s), billed hourly as needed for the engagement.

Customer responsibilities

Provide access to related documentation and in-scope systems.

NIS 2 Gap Assessment

Scope

Assessment of your existing controls, infrastructure, policies, procedures, and documentation to perform a gap analysis against NIS 2 requirements.
Creation of a report with a detailed roadmap of remediation efforts across people, process, and technology for all unmet requirements.

Deliverables

Detailed readiness assessment covering your environment, policies, procedures, personnel, and controls.
Remediation plan with prioritized steps and regular meetings to track progress.

Personnel & timeline

Security consultant(s) assigned to the engagement; expected turnaround of 4 to 6 weeks depending on scope.

Customer responsibilities

Provide access to related documentation and in-scope systems.

NIS 2 Launch

Scope

Assessment of your existing controls, infrastructure, and documentation to perform a gap analysis against NIS 2 requirements.
Workshops on NIS 2 processes and implementation strategies for your stakeholders and technical teams.
Creation of a report with a detailed remediation roadmap across people, process, and technology.

Deliverables

Detailed readiness assessment of your environment, policies, procedures, personnel, and controls.
Delivery of workshops covering NIS 2 requirements.
Remediation plan with prioritized steps and regular meetings to track progress.

Personnel & timeline

Security consultant(s) assigned to the engagement; typical timeline of 12 to 16 weeks depending on scope.

Customer responsibilities

Provide access to related documentation and in-scope systems.

Frequently asked questions

What is the NIS 2 Directive?

NIS 2 is the European Union's updated cybersecurity directive, expanding risk-management, governance, and incident-reporting obligations to more "essential" and "important" entities.

Who does NIS 2 apply to?

Medium and large organizations operating in covered critical sectors within the EU, plus certain others designated by member states.

When does NIS 2 take effect?

EU member states have transposed NIS 2 into national law, with enforcement rolling out - organizations should be aligning controls and reporting processes now.