NIS-2 in force — German transposition in progress. Build the buffer now.

Pass NIS2 on time — without the consultant overhead.

NIS2 readiness audit for mid-sized manufacturers. Technical review, clear recommendations, report in two weeks — from a single source.

Book a 30-minute intro call

Are you actually in scope?

The NIS-2 directive targets medium and large entities in critical sectors — energy, transport, health, digital infrastructure, food, manufacturing and more. The three indicators below give you a first orientation. They don't replace a case-by-case legal assessment, but they help you start the conversation inside your own company.

The following is a technical assessment and does not constitute legal advice under the German Legal Services Act (RDG).

SectorYour company would potentially be in scope if it operates in one of the sectors listed in Annex I or II of the NIS-2 directive (e.g. energy, transport, health, drinking water, digital infrastructure, manufacturing from certain sub-industries onward).

SizeThresholds apply to medium-sized entities from 50 employees or €10M annual revenue. Larger entities from 250 employees or €50M can be classified as “essential.”

Key datesThe EU deadline of 17 October 2024 has passed. The German NIS2UmsuCG transposition is in progress — the current status should be verified before the audit starts.

Suppliers to entities in scope, and EU activities of non-EU operators, can also fall into scope. If two or more of the three points apply, a technical assessment is worthwhile — that's exactly what the readiness audit exists for.

How the NIS2 readiness audit runs.

Four steps, clearly paced. No consultant theatre, no slideware overhead. You get a technical report that holds up before a supervisory review — and an action plan your team can work with immediately.

All four audit steps in detail

1. Scoping, asset inventory & Art. 21 mappingWe define the scope together: which sites, which systems, which OT lines, which cloud workloads. The result is a prioritised asset inventory. In parallel, the ten minimum measures from Art. 21 of the directive are mirrored against the current state — from risk management through incident handling to supply-chain security. Every point gets a maturity rating and a concrete gap description.

2. Technical review & documentation reviewConfiguration review, authentication, network segmentation, patch status, backup and recovery processes. For OT lines, extended to PLC/HMI reachability, remote-access paths, and update discipline. Methodology aligned with IEC 62443 (OT) and OWASP ASVS (backend/API). In parallel: security policy, risk register, incident response plans and evidence — with an eye on what a supervisory authority will want to see later.

3. Findings & prioritisationEvery finding is prioritised by impact and effort: immediate, mid-term, strategic. You don't get a 200-page list — you get a plan a two- to five-person IT/OT team can work from over the next weeks.

4. Handover & optional implementationReport, action plan, debrief with your team. If you want, I take on the implementation of critical fixes myself afterwards — no handover to subcontractors, no second contract with a third party.

Two weeks from kickoff to report, three to five person-days of effort on your side, one contact person throughout.

What makes this audit different.

Two differences from traditional NIS2 consultancies.

What that means in concrete terms

Embedded/OT heritage + audit and fix from one personGerman journeyman certification in electrical automation (Gesellenbrief Elektroautomationstechnik) plus ten years of embedded and backend development. PLCs, firmware, fieldbus — not buzzwords, workbench. That's the difference between an audit that says “OT risks must be addressed” and one that says “the HMI line at plant 3 opens a tunnel into the office network, here is the fix.” Whoever found the gap can close it — cleanly, traceably, and documented. No three-phase contract stack with an audit partner, an implementation partner, and a managed-service partner. Optional, never pushed.

Technical, not governance-onlyMany NIS-2 consultancies deliver clean policies and audit trails on paper. This audit covers the same obligations mapping and goes one layer deeper into the configuration: which services are running, which access paths are actually open, which patches are missing. You get both — from a single source.

From real projects.

A mid-sized mechanical engineering company commissioned an Azure security audit with a Zero Trust roadmap in early 2026. Duration: two weeks. Result: three high-impact findings with a concrete remediation path, handed over to internal DevOps and management.Reference available on request

For a legal-protection insurer in the DACH region I owned the backend and security portions of customer-facing claims-process flows — including secure API integration, session handling, and stability under production load.Reference available on request

What you hold in your hand at the end.

Four phases, two weeks of net processing time.

Week 0 — Kickoff (90 minutes remote)

Week 1 — Inventory

Week 2 — Deep dive & report

End of week 2 — Handover

Artefacts (what you get)

Audit report (PDF, 30–60 pages depending on scope) with executive summary, methodology, findings, and an Art. 21 maturity matrix.

Findings list with impact, effort, priority, and an ownership suggestion.

Action plan as an editable document (Markdown or Excel — your choice).

Mapping table: Art. 21 NIS-2 ↔ current state ↔ recommendation.

Optional: two-page management summary for internal reporting.

All artefacts are yours. No lock-in tooling, no platform dependency.

What it costs.

A NIS2 readiness audit lands between €3,000 and €5,000 net, depending on scope (sites, OT share, cloud footprint). The range is fixed before the contract is signed — no hourly-billing surprise at the end.Optional retainer from €800 net per month. For companies that want continuous support after the audit: monthly security report, configuration drift check, availability for incident questions. Cancellable at the end of each month.Intro call is free and non-binding. 30 minutes, video or phone. By the end you'll know whether the audit makes sense and what it would concretely cost in your case.

Frequently asked questions.

Am I actually in scope for NIS2?

What does a NIS2 readiness audit cost at Büngener Software?

How does the audit run and how long does it take?

What do I end up with?

Is this legal advice?

How fast can you start?

Book a 30-minute intro call

Free, non-binding, directly with the person who will then also run the audit.

Book a 30-minute intro call

Start NIS2 self-check

Deeper security work — backend, cloud, embedded

If the audit surfaces concrete fixes, I take them on from a single source. Methodology background: Embedded Security Audit for IoT & OT and Backend Security Audit — API, cloud & secure code.

The content on this page is not legal advice under the German Legal Services Act (RDG).The content on this page serves as technical orientation for people responsible inside affected companies. It does not constitute legal advice and does not replace a case-by-case legal review. Büngener Software provides technical audits and implementation only.