Compliance & Security · NIS2
NIS2 Implementation: From Scope Assessment to Working ISMS
NIS2 makes cybersecurity a management responsibility, with registration duties, incident reporting deadlines and personal liability. We take you from "does this apply to us?" to a working, auditable security organization.
How we work
01 · Scope & gap
Are you an essential or important entity? Which services and suppliers are in scope? Gap analysis against the NIS2 risk-management measures, including supply-chain security.
02 · Build
ISMS build-up aligned with ISO 27001, incident-response and 24h/72h reporting processes, policies that fit your organization instead of shelf-ware, and management training.
03 · Operate & prove
Audit preparation, evidence management, continuous improvement, and where OT and embedded systems are involved, we test the systems themselves, not just the paperwork.
Frequently asked
Does NIS2 apply to my company?
If you operate in one of the 18 listed sectors and exceed 50 employees or €10M turnover, most likely yes. Data-center services are explicitly covered as critical digital infrastructure. We clarify your scope in a short assessment.
What are the reporting deadlines?
Significant incidents require an early warning within 24 hours and a detailed notification within 72 hours. That only works with prepared processes, we build and rehearse them with you.
We already have ISO 27001. Are we done?
A certified ISMS is a strong foundation, but NIS2 adds registration duties, reporting obligations, supply-chain requirements and management accountability. We map your existing ISMS against the delta.
Why micara and not a pure consultancy?
Because we build embedded and OT systems ourselves, we can assess the technical reality behind your compliance, from firmware to network segmentation, not just the documentation.