NIS-2 in force: German transposition in progress. Build the buffer now.

Pass NIS2 on time, without the consultant overhead.

NIS2 readiness audit for mid-sized manufacturers. Technical review, clear recommendations, report in two weeks, from a single source.

Book a 30-minute intro call

Are you actually in scope?

The NIS-2 directive targets medium and large entities in critical sectors, energy, transport, health, digital infrastructure, food, manufacturing and more. The three indicators below give you a first orientation. They don't replace a case-by-case legal assessment, but they help you start the conversation inside your own company.

The following is a technical assessment and does not constitute legal advice under the German Legal Services Act (RDG).

Sector

Your company would potentially be in scope if it operates in one of the sectors listed in Annex I or II of the NIS-2 directive (e.g. energy, transport, health, drinking water, digital infrastructure, manufacturing from certain sub-industries onward).

Size

Thresholds apply to medium-sized entities from 50 employees or €10M annual revenue. Larger entities from 250 employees or €50M can be classified as “essential.”

Key dates

The EU deadline of 17 October 2024 has passed. The German NIS2UmsuCG transposition is in progress, the current status should be verified before the audit starts.

Suppliers to entities in scope, and EU activities of non-EU operators, can also fall into scope. If two or more of the three points apply, a technical assessment is worthwhile, that's exactly what the readiness audit exists for.

How the NIS2 readiness audit runs.

Four steps, clearly paced. No consultant theatre, no slideware overhead. You get a technical report that holds up before a supervisory review, and an action plan your team can work with immediately.

→ The ten core measures of Art. 21 in detail →

All four audit steps in detail

1. Scoping, asset inventory & Art. 21 mapping

We define the scope together: which sites, which systems, which OT lines, which cloud workloads. The result is a prioritised asset inventory. In parallel, the ten minimum measures from Art. 21 of the directive are mirrored against the current state, from risk management through incident handling to supply-chain security. Every point gets a maturity rating and a concrete gap description.

2. Technical review & documentation review

Configuration review, authentication, network segmentation, patch status, backup and recovery processes. For OT lines, extended to PLC/HMI reachability, remote-access paths, and update discipline. Methodology aligned with IEC 62443 (OT) and OWASP ASVS (backend/API). In parallel: security policy, risk register, incident response plans and evidence, with an eye on what a supervisory authority will want to see later.

3. Findings & prioritisation

Every finding is prioritised by impact and effort: immediate, mid-term, strategic. You don't get a 200-page list, you get a plan a two- to five-person IT/OT team can work from over the next weeks.

4. Handover & optional implementation

Report, action plan, debrief with your team. If you want, I take on the implementation of critical fixes myself afterwards, no handover to subcontractors, no second contract with a third party.

Two weeks from kickoff to report, three to five person-days of effort on your side, one contact person throughout.

What makes this audit different.

Two differences from traditional NIS2 consultancies.

What that means in concrete terms

Embedded/OT heritage + audit and fix from one person

German journeyman certification in energy and building technology (Gesellenbrief Energie- & Gebäudetechnik) plus ten years of embedded and backend development. PLCs, firmware, fieldbus, not buzzwords, workbench. That's the difference between an audit that says “OT risks must be addressed” and one that says “the HMI line at plant 3 opens a tunnel into the office network, here is the fix.” Whoever found the gap can close it, cleanly, traceably, and documented. No three-phase contract stack with an audit partner, an implementation partner, and a managed-service partner. Optional, never pushed.

Technical, not governance-only

Many NIS-2 consultancies deliver clean policies and audit trails on paper. This audit covers the same obligations mapping and goes one layer deeper into the configuration: which services are running, which access paths are actually open, which patches are missing. You get both, from a single source.

From real projects.

A software company commissioned the architecture and automation of its enterprise deployment for regulated environments (SCCM, Intune, GPO) in early 2026, system-wide installation, context detection and code signing, handed over to the internal DevOps organization.
Reference available on request

For a legal-protection insurer in the DACH region I owned the backend and security portions of customer-facing claims-process flows, including secure API integration, session handling, and stability under production load.
Reference available on request

What you hold in your hand at the end.

Four phases, two weeks of net processing time.

Week 0: Kickoff (90 minutes remote)

Week 1: Inventory

Week 2: Deep dive & report

End of week 2: Handover

Artefacts (what you get)

Audit report (PDF, 30–60 pages depending on scope) with executive summary, methodology, findings, and an Art. 21 maturity matrix.

Findings list with impact, effort, priority, and an ownership suggestion.

Action plan as an editable document (Markdown or Excel, your choice).

Mapping table: Art. 21 NIS-2 ↔ current state ↔ recommendation.

Optional: two-page management summary for internal reporting.

All artefacts are yours. No lock-in tooling, no platform dependency.

What it costs.

Three levels instead of a price list. The entry tier assesses where you stand, the middle tier is the full audit, the premium tier covers six months of continuous security coverage — with remediation and response times, not just a report.

Security Health Check Monthly

Entry

from €990

per month

Monthly deep scan across the current landscape
Patch review for operating systems, containers and dependencies
Configuration drift check
One-page report every month
Availability for incident questions, cancellable at the end of each month

Request this package

NIS2 Readiness Audit

from €3,000

up to €5,000

within 2 weeks

Technical review against NIS-2 Art. 21
Asset inventory and risk analysis
Findings and action plan
Report in two weeks

NIS2 Security Closure Package

from €14,900 · for 3 months

Request this package

Total Security Care

Premium

€28,000

for 6 months

Full audit: NIS-2 Art. 21, OT exposure, cloud footprint, asset inventory
6 months of health checks — monthly deep scan, patch review, drift check, one-page report
Remediation of every finding from two audit rounds (priority 1 and 2) — code, hardening, cloud configuration
NIS-2 evidence package: asset inventory, Art. 21 mapping, action plan with owner and deadline — ready for regulators and auditors
Incident response SLA: binding acknowledgement in under one hour, 24/7 on-call with named backup
Quarterly re-audits, SBOM and CVE monitoring
2 management workshops, quarterly reporting to the executive level
One contact person for the entire term, no sub-contractors

Response time means a binding acknowledgement with an initial assessment, not the fix itself. Backup coverage during absence is named. Night and holiday surcharges are included in the fixed price — no hourly contingency, no follow-up billing.

Request this package

All prices net. The scope is fixed before the contract is signed — no hourly billing, no sub-consultant margins.

Intro call is free and non-binding. 30 minutes, video or phone. By the end you'll know whether the audit makes sense and what it would concretely cost in your case.

Frequently asked questions.

Am I actually in scope for NIS2?

What does a NIS2 readiness audit cost at Büngener Software?

€3,000 to €5,000 net depending on scope, with the range fixed before the contract is signed. Optional retainer from €990 net per month. If you want to be covered continuously rather than audited once, the Total Security Care package runs six months of coverage for €28,000 net, fixed price, including remediation and a response time of under one hour. No hidden hourly rates, no sub-consultant margins.

How does the audit run and how long does it take?

What do I end up with?

Is this legal advice?

How fast can you start?

Book a 30-minute intro call

Free, non-binding, directly with the person who will then also run the audit.

Book a 30-minute intro call

Start NIS2 self-check

Deeper security work, backend, cloud, embedded

If the audit surfaces concrete fixes, I take them on from a single source. Methodology background: Embedded Security Audit for IoT & OT and Backend Security Audit: API, cloud & secure code.

The content on this page is not legal advice under the German Legal Services Act (RDG).

The content on this page serves as technical orientation for people responsible inside affected companies. It does not constitute legal advice and does not replace a case-by-case legal review. Büngener Software provides technical audits and implementation only.