Entity classification
Essential, important, or out of scope, with the sector, size, and country facts behind the answer.
The Problem
Your Company Grew Into NIS2 Scope and Nobody Noticed
It shows up when a national authority asks you to register or a customer adds NIS2 clauses to a renewal. It also shows up when the board learns its members can be held liable.
Scope
Nobody knows if you're essential, important, or out of scope.
Scope
Sector, size, and main establishment checked, with the national law that applies to you.
Reporting
Incidents get handled in chat, with no early warning step.
Reporting
A written path for the 24-hour warning, 72-hour notice, and final report.
Suppliers
Supplier contracts say nothing about security or incidents.
Suppliers
Security clauses and a short questionnaire for the suppliers your service depends on.
Management
Management hasn't approved any cybersecurity measures yet.
Management
A briefing, an approval record, and training notes an authority can review.
Your logistics firm passed 50 staff two years ago. Now a registration notice from the national authority sits in a shared inbox, and a large customer wants proof of NIS2 measures before renewal. Nobody knows whether you're an essential or an important entity, or which country's law applies. Incidents get handled in a chat thread, with no 24-hour early warning step. Management hasn't approved any measures, and under NIS2 the people running the company can be held responsible for that.
We start by settling scope: your sector, size, and main establishment decide whether NIS2 applies and which national law you follow. Then we check each of the ten Article 21 measures against what you actually run, from backups to supplier contracts. We build the reporting path on the 24-hour, 72-hour, and one-month clock and record management's approval. You get a program sized to your company, not one copied from a bank.
Scope settled first
Sector, size, and country decide whether NIS2 applies, so we answer that before any gap work.
Ten measures, one by one
Each Article 21 measure is checked against your real tools, contracts, and processes.
A reporting clock you can meet
A 24-hour early warning, 72-hour notification, and one-month final report path with owners.
Our NIS2 Compliance Process
From Scope Decision to Reporting Readiness in Five Clear Steps
You confirm the scope facts, approve the gap list and fix order, and sign off each policy before it goes to your management body.
We ask about your sector, headcount, turnover, EU establishments, and the customers asking about NIS2. You learn whether the directive likely applies and get a fixed quote for the next steps.
What's Included
What You Get Against the NIS2 Directive Requirements
Each project covers scope, a gap check against the NIS2 compliance requirements in Article 21, the policies and playbook your plan includes, supplier security, and an evidence register.
Compare Options
DeveloperLook vs Large Consultancy vs Compliance Software
Large consultancies suit groups across many countries, and compliance software tracks tasks well. Here is where each fits for a mid-sized company and where it stops.
| Feature | DeveloperLookBest fit | Large consultancy | Compliance software |
|---|---|---|---|
| Scope decision | Facts gathered, counsel confirms | Strong, with in-house legal teams | Questionnaire, self-reported |
| Gap check | Ten measures against real tools | Thorough, often interview-based | Template controls to tick |
| Policies | Sized to your company | Often long and generic | Template library included |
| Technical fixes | MFA, logging, and backups set up | Usually handed to others | Not included |
| Reporting playbook | 24-hour, 72-hour, and one-month steps | Strong, often generic | Task reminders only |
| Many countries | Main country plus national notes | Strong across many member states | Depends on the vendor's content |
| Cost | Fixed price from $1,000 | High day rates | Yearly license fee |
| Ongoing tracking | Handed back with a register | A separate engagement | Strong, built for it |
DeveloperLook
Large consultancy
- Scope decision
- DeveloperLook: Facts gathered, counsel confirmsLarge consultancy: Strong, with in-house legal teams
- Gap check
- DeveloperLook: Ten measures against real toolsLarge consultancy: Thorough, often interview-based
- Policies
- DeveloperLook: Sized to your companyLarge consultancy: Often long and generic
- Technical fixes
- DeveloperLook: MFA, logging, and backups set upLarge consultancy: Usually handed to others
- Reporting playbook
- DeveloperLook: 24-hour, 72-hour, and one-month stepsLarge consultancy: Strong, often generic
- Many countries
- DeveloperLook: Main country plus national notesLarge consultancy: Strong across many member states
- Cost
- DeveloperLook: Fixed price from $1,000Large consultancy: High day rates
- Ongoing tracking
- DeveloperLook: Handed back with a registerLarge consultancy: A separate engagement
Projects We've Built
Logistics, Health, and Delivery Platforms We Have Built
Logistics, medical, and delivery platforms from our portfolio. Each shows our engineering on live products in regulated sectors, rather than earlier NIS2 engagements.
Logify Project Risk and Control Management Web App
- Logistics & Transportation
- Construction
- Dashboard
LifePulse Medical Web Design & Development
- Medical
- Booking System
- Dashboard
MediPulse Medical App Design & Development
- Medical
- Booking System
- Dashboard
ZapEats Restaurant Food Delivery App Design & Development
- Food & Beverage
- Food Delivery
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Mid-Sized Companies Trust Us With NIS2
NIS2 puts duties on the company and on the people who run it. These habits keep the work proportionate and the facts straight.
Proportionate, not maximal
NIS2 asks for measures that fit your size and risk. We size policies and fixes to your company instead of copying a bank's program.
Counsel confirms national law
Each member state wrote its own NIS2 law and deadlines. We flag the national points, and your counsel confirms them before you rely on them.
Clock-first incident planning
We test whether a real incident could reach the authority within 24 hours. If that path breaks, we fix it first.
Plain answers on scope
If NIS2 doesn't apply to you, we say so after the scoping call. You save the cost of a program you don't need.
Supplier view included
Many companies meet NIS2 through their customers' supplier clauses. We write your answers so they work for every EU customer who asks.
Quotes fixed before work starts
Once scope and entity type are clear, you get a fixed quote. Extra entities or countries are priced before we start on them.
Overview
What does NIS2 compliance require from a company?
DeveloperLook delivers nis2 compliance work for companies newly in scope and for non-EU suppliers to EU customers. We classify your entity, gap-check the ten Article 21 measures, and build the reporting path for the 24-hour, 72-hour, and one-month deadlines. Projects start at $1,000 and take 2 to 12 weeks, with legal points left to your counsel.
DEVELOPERLOOK
Project facts · NIS2 Compliance Services
- Service
- NIS2 compliance services (scope decision, Article 21 gap check, reporting playbook, fixes)
- Typical timeline
- 2 to 3 weeks to assess, 5 to 12 weeks to implement
- Serving
- Companies in NIS2 sectors and their non-EU suppliers
- Built with
- Microsoft Entra ID, Google Workspace, Wazuh, Jira, Confluence
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 60 days of questions and evidence help
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $1,000 USD, fixed scope after a scoping call
Reviewed 26 Oct 2026 by Saimul Islam
Good fit
Mid-sized firms in NIS2 sectors
Your company passed 50 staff in transport, health, energy, or manufacturing, and you need to know whether you're now essential or important.
Non-EU SaaS and IT suppliers
Your EU customer's contract asks you to prove NIS 2 compliance for the services you supply, and your company is based in the US or UK.
Managed service providers serving the EU
Your MSP manages systems for EU clients, and managed service providers now sit inside NIS2 with their own technical requirements.
Boards asked to approve measures
Your management body has to approve the NIS2 cybersecurity measures and take training, and nobody has prepared a briefing it can sign.
Companies with a registration notice
Your national authority asked you to register as an essential or important entity, and the form wants details nobody has collected.
Not a fit
Financial entity under DORA
You're a bank, insurer, or investment firm covered by DORA. Our DORA Compliance Support page covers that sector-specific regime instead.
Need a legal opinion
You need a legal opinion on your entity type or national obligations. An EU cybersecurity lawyer should give that, and we can support their work.
Want an ISO 27001 certificate
You want a certificate customers recognize worldwide. Our ISO 27001 Consulting page builds that management system, which also covers much of NIS2.
Clearly out of scope
You have under 50 staff, modest turnover, and no sector listed in NIS2. A security baseline from our Cybersecurity Services page fits better.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for NIS2 Compliance Services
These are starting points in USD. Your final price depends on your entity type, countries, suppliers, and current controls, and you get a fixed proposal after a free scoping call.
For Agencies
White-Label NIS2 Requirements Work for MSPs and IT Partners
You own the client relationship. We supply the scope decisions, gap checks, and reporting playbooks under your brand, so your EU clients get NIS2 work without you building a compliance team.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the client brief
Send the client's sector, headcount, countries, and any authority or customer requests.
- Client needs
- You share the details
- Details received
We scope and assess
We settle the entity type and check the ten measures, then draft a plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Fix and hand off
We write the playbook, close agreed gaps, and hand over a white-label evidence register.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the client's sector, headcount, countries, and any authority or customer requests.
- Client needs
- You share the details
- Details received
We scope and assess
We settle the entity type and check the ten measures, then draft a plan for your review.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Fix and hand off
We write the playbook, close agreed gaps, and hand over a white-label evidence register.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We work in the identity, logging, and backup tools you already run, and track every measure in a register your team keeps.
- Microsoft Entra ID
- Google Workspace
- Okta
- YubiKey
- Microsoft Sentinel
- Wazuh
- Microsoft Defender for Endpoint
- Greenbone OpenVAS
- Veeam
AWS Backup
Azure Backup- Restic
- Jira
- Confluence
- Microsoft Excel
- ENISA implementation guidance
01 / 04
Related Services
Companies often pair NIS2 work with an ISO 27001 system, incident planning, supplier reviews, and steady vulnerability management.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
DORA Compliance Support
DeveloperLook provides DORA compliance support for EU financial entities and their ICT providers. We map critical functions, write the ICT risk framework and incident playbook, build the register of information, and test resilience against the DORA requirements.
ISO 27001 Consulting
DeveloperLook provides ISO 27001 consulting services for SaaS and service companies: scope, risk assessment, a Statement of Applicability for all 93 Annex A controls, the documents the standard requires, and audit support. Your system stays small enough to run.This page
NIS2 Compliance Services
Pairs with the 6 services around it
Incident Response Plan Development
DeveloperLook provides incident response plan development for growing companies. We write the roles, first-hour checklist, and playbooks for your likeliest incidents, following the NIST incident response plan guidance, and set a testing schedule you can keep.
Vendor Risk Management Services
DeveloperLook provides vendor risk management services for growing companies. We list and tier every vendor, review the critical ones through their SOC 2 reports, and set up a vendor risk management program your team can run. Review effort follows each vendor's real risk.
Vulnerability Management Services
DeveloperLook runs vulnerability management services for growing companies and IT teams. We scan monthly, rank findings by real exploit risk, and give each one an owner and a deadline in your tracker. Rescans prove every fix, so the backlog shrinks on a schedule.FAQ
Frequently Asked Questions
Straight answers on cost, timing, scope, the directive itself, and what it takes to stay compliant.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
NIS2 work with us starts at $1,000 for a scope decision and a gap check of the ten Article 21 measures. A readiness program with policies, a reporting playbook, and supplier clauses starts at $3,450. Implementation with technical fixes and an evidence register starts at $7,100. Prices are in USD and fixed after scoping.
A scope decision and gap check take 2 to 3 weeks. A readiness program takes 5 to 7 weeks, and full implementation takes 8 to 12 weeks. The slowest parts are usually supplier contracts and MFA rollouts, so we start those early while the policies are drafted.
NIS2 applies to medium and large entities in 18 sectors, from energy, transport, and health to digital infrastructure, ICT service management, manufacturing, and postal services. Some entities, such as DNS and trust service providers, fall in scope regardless of size. Member states can also add smaller entities with a high risk profile.
It does if your company is medium-sized or larger and works in a sector NIS2 lists, or your country named you directly. Medium generally means 50 or more staff, or turnover and balance sheet above €10 million. Non-EU providers of services such as cloud or managed services in the EU may also need an EU representative.
It means having the risk-management measures, incident reporting, and management oversight the directive requires, as written into your country's law. In practice that's policies, technical controls, a reporting path, supplier security, and a management body that has approved it all. It isn't a one-time purchase: the evidence has to stay current.
NIS2 stands for the second Network and Information Security Directive, which replaced the original 2016 NIS Directive. The EU adopted it as Directive (EU) 2022/2555. It covers far more sectors than the first version and sets stricter rules on incident reporting, supply chains, and management responsibility.
The NIS2 directive is EU law that sets a common cybersecurity baseline for important sectors. Many people call it the NIS2 regulation, but as a directive it needed a national law in each member state, due by 17 October 2024. Those laws must allow fines of at least €10 million or 2% of worldwide turnover for essential entities.
Start by confirming scope and your national law, then check the ten Article 21 measures against what you run. Close the gaps, write the incident reporting path, get management approval, and keep the evidence current. Nobody can promise how an authority will judge you, but a documented program sized to your risk shows the duty was taken seriously.
No. Vulnerability scanning supports one Article 21 measure, the handling and disclosure of vulnerabilities, but it covers none of the others. You still need policies, incident handling, continuity, supplier security, access control, cryptography, training, and management approval. Our Vulnerability Management Services page covers ongoing scanning if you need it.
Staying NIS2 compliant means keeping the register current, reviewing measures every year, retraining the management body, and testing the reporting path. You get 60 days of questions and evidence help after handover. Most clients then run the register themselves, using the owners and review dates we set together.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.