Essential and important entities
- Sectors listed by the directive
- Medium and large companies in principle, some entities regardless of size
- Registration with ANSSI
Cybersecurity & Governance
NIS2 compliance
Find out whether your organisation is in scope, measure the gap with the requirements and build a realistic roadmap, owned by management. Available in the Paris region, Lyon, Chambéry, Annecy and Geneva, or remotely anywhere in France and French-speaking Switzerland.
The challenge
NIS2 changes the scale.
The European NIS2 directive extends cybersecurity obligations to thousands of organisations, split into essential and important entities, across many sectors: energy, transport, health, digital, manufacturing, food, postal services, waste management and more. In France, ANSSI is the authority in charge of its implementation.
Requirements cover governance, risk management, supply chain security and incident reporting. Management bodies must approve the measures and can be held accountable.
Who it is for
Organisations discovering their obligations.
Suppliers to regulated entities
- Security requirements passed down by your customers
- Contract clauses and questionnaires to meet
- Demonstrating credible maturity
Multi-entity groups
- Scope to qualify entity by entity
- Common policy and local implementation
- Alignment with other frameworks (ISO 27001, GDPR)
Missions
Our NIS2 support
01
Qualification
Determine whether your entities are in scope, and as essential or important.
02
Gap analysis
Assessment of your existing measures against the directive's requirements.
03
Risk management
EBIOS RM risk analysis and prioritised treatment plan.
04
Incidents and reporting
Detection, response and reporting procedures within the required deadlines.
05
Supply chain
Assessment of critical suppliers and contractual security requirements.
06
Governance and management
Roles and responsibilities, management training, tracking indicators.
Method
How the engagement works
Qualification
A first conversation to establish whether and how NIS2 applies to you.
Gap analysis
Measuring your current level against the requirements.
Roadmap
Actions prioritised by risk and effort, approved by management.
Implementation
Plan management, documentation and preparation for inspections.
Why Axiomata
Compliance that holds up in practice.
Over eight years of hands-on experience as CISO, DPO and infrastructure architect, in groups of more than 1,000 employees as well as startups, across retail, maritime and defence.
NIS2 overlaps heavily with ISO 27001 and the GDPR: we pool efforts across frameworks and translate requirements into concrete technical measures (Active Directory, networks, Microsoft cloud).
FAQ
NIS2: your questions
Is my company in scope of NIS2?
It depends on your sector and size: in principle, medium and large companies in the sectors listed by the directive, and some entities regardless of size. Precise qualification is the first step.
What is the difference between essential and important entities?
Both categories have comparable security obligations; they differ mainly in the supervision regime and the level of penalties, which is higher for essential entities.
What are the incident reporting obligations?
Significant incidents must be reported to the authority on a strict timeline: an early warning within 24 hours, a notification within 72 hours, then a final report within a month.
Do you work remotely?
Yes. Much of the work is done remotely, anywhere in France and French-speaking Switzerland, with occasional on-site visits for workshops, committees or crisis management. We work on site in the Paris region, Lyon, Chambéry, Annecy and Geneva.
Are NIS2 and ISO 27001 the same thing?
No, but they overlap heavily. An ISO 27001 management system covers a large share of NIS2 measures and makes compliance easier to demonstrate.
Related expertise
Go further
Let's review your NIS2 position.
A first conversation to frame your challenges, with no commitment. We work in the Paris region, Lyon, Chambéry, Annecy and Geneva, and remotely anywhere in France and French-speaking Switzerland, with occasional on-site visits.
Talk to an expert