Compliance & Security · NIS2
NIS2 Implementation: From Scope Assessment to Working ISMS
NIS2 makes cybersecurity a management responsibility, with registration duties, incident reporting deadlines and personal liability. We take you from "does this apply to us?" to a working, auditable security organization.
How we work
01 · Scope & gap
Are you an essential or important entity? Which services and suppliers are in scope? Gap analysis against the NIS2 risk-management measures, including supply-chain security.
02 · Build
ISMS build-up aligned with ISO 27001, incident-response and 24h/72h reporting processes, policies that fit your organization instead of documents nobody reads, and management training.
03 · Operate & prove
Audit preparation, evidence management, continuous improvement, and where OT and embedded systems are involved, we test the systems themselves, not just the paperwork.
Frequently asked
Does NIS2 apply to my company?
If you operate in one of the 18 listed sectors and have 50 or more employees, or turnover and balance-sheet totals above €10 million, then most likely yes. Data-center services are explicitly covered as critical digital infrastructure. We clarify your scope in a short assessment.
What are the reporting deadlines?
Significant incidents require an early warning within 24 hours and a detailed notification within 72 hours. That only works with prepared processes. We build them with you and rehearse them.
We already have ISO 27001. Are we done?
A certified ISMS is a strong foundation, but NIS2 adds registration duties, reporting obligations, supply-chain requirements and management accountability. We map your existing ISMS against the delta.
Why micara and not a pure consultancy?
Because we build embedded and OT systems ourselves, we can assess the technical reality behind your compliance, from firmware to network segmentation, not just the documentation.