%20(17).png)
Does your company potentially fall under the NIS2 implementation act and need to demonstrably fulfill risk management measures, reporting obligations, and management responsibilities?
Since the revised BSI Act came into force, the requirements of EU Directive 2022/2555 now also apply in Germany. Significantly more companies are affected than before, with personal obligations for management.
Certinova guides you efficiently through the entire process: from the impact assessment and gap analysis to implementation, as well as effectiveness and compliance verification. Where appropriate, we build upon your existing ISO 27001-based ISMS.
Gain clarity now, before the authorities come knocking.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current level of maturity—without detours and without overhead.
We clarify whether and as what type of entity you fall under NIS2 (essential or important entity), which parts of your company are affected, and what obligations follow, including registration with the BSI. You will receive a reasoned, documented assessment.
.svg)
We evaluate your measures against the requirements of the BSIG and NIS2 regarding risk management, reporting capabilities, and supply chain security. Based on your existing ISMS or ISO 27001 status, we identify gaps and prioritize measures in an actionable roadmap.
.svg)
We support you throughout the implementation process: risk management, reporting processes with mandatory deadlines, management training, supplier management, and documentation. You retain responsibility, while we provide the structure and momentum.
.svg)
We assess whether your measures are appropriate and effective, and document the results in a way that stands up to scrutiny from regulators, customers, and committees. Where the law requires evidence to be submitted to the BSI, we will prepare it for you.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From scope of impact and management responsibilities to the distinction between ISO 27001 and DORA: find the most important answers here.
Can't find your question? Please contact us directly.
The key factors are your sector, company size (number of employees, revenue, balance sheet total), and the nature of your activities. Companies that only meet some of the criteria may also be affected, for example, through corporate structures. We will clarify this in a binding and documented impact assessment.
No. NIS2 is a legal requirement, not a certifiable standard. However, you can demonstrate compliance through independent audits and reports, such as an ISMS based on ISO 27001 or corresponding verification audits. We will determine which format is right for you during the scoping phase.
Management must approve risk management measures, oversee their implementation, and undergo regular training. Failure to comply can result in personal liability. We provide support through training and documented decision-making foundations.
Significant security incidents must be reported in stages: an early warning within 24 hours, a notification within 72 hours, and a final report no later than one month after the incident. We review and structure your reporting process to ensure these deadlines are realistically met.
Let's get in touch to discuss your requirements.
