NIS2 applies to your company.
In five days I tell you what you can prove.
Most companies do not know what their existing security measures are worth, not in front of the BSI, insurers, corporate procurement or their own management. I qualify your measures using the method of the regulated industry: installation, operation, and performance. What remains at the end is a written Qualification Report that stands up to an audit.
Typical triggers: security questionnaires from corporate customers, insurer renewals, authority audit requests, tabletop exercises your board or auditor demands.
NIS2 transposition law in force since March 6, 2026. All obligations are legally binding immediately.
If you answer yes to any of these - act now.
You don't know whether NIS2 applies to your company
No documented risk analysis in the last 12 months
Backups have never been tested in a real scenario
Nobody knows who decides during an incident and what happens
You can't prove that your security measures actually work
Your board members do not know their personal liability
A single one of these gaps can have legal consequences for the management during a BSI audit or an incident.
Free NIS2 quick check
No login. No data storage. All input stays in your browser. At the end you receive an individual report with prioritised recommendations.
Why three stages instead of one checklist?
Clarity in 5 working days. Fixed price. No consulting marathon.
How the engagement runs
1. Clarification call
30 minutes, free. Confirmation: affected by NIS2? If not - no qualification, no cost. Define scope. Includes the free NIS2 Registration Check: we confirm whether your company is obliged to register with the competent authority. The registration deadline runs from the day the obligation applies, not from the day you find out.
You + Jan Richter · Day 0
2. Review
Remote. You run the qualification protocols in your own environment and send the raw outputs. I assess each measure against NIS2 Art. 21(2)(a)-(j), GDPR, BSI IT-Grundschutz and NIS2-UmsG across all three qualification stages.
Jan Richter · Day 1–3
3. Qualification Report
Your signed Qualification Report: per-measure verdicts with execution evidence, action plan, director-liability check, 1-hour debriefing with management.
Jan Richter · Day 5
- ✅ Per-measure qualification: Qualified, Conditionally Qualified, or Not Yet Qualified - with execution evidence references, not policy citations
- ✅ Deviations and open gaps: named and sorted by severity, as a component of the report
- ✅ Action plan: what first, what later, what optional - with effort estimates
- ✅ Director-liability check: personal risks of the management
- ✅ BSI audit readiness: can you withstand a BSI audit?
- ✅ Execution evidence: not "does a policy exist?" but "does it work?"
- ✅ Executive summary: decision-ready for the management
- ✅ 1-hour debriefing: joint walk-through of the results
Fixed prices. No surprises. No lock-in.
Every engagement ends with a document that belongs to you. After that you are free.
Free NIS2 Quick Check
Are you affected? Clarity in 3 minutes.
- ✅ Quick check against NIS2 Annex I & II
- ✅ Size-criteria check (employees, turnover)
- ✅ Initial assessment: Essential or Important Entity
- ✅ Result as download
Qualification - NIS2, GDPR or ISO 27001
In 5 working days, a written execution evidence of your security posture.
You choose the framework. Same method, same price. Against ISO we qualify the 27001-relevant control requirements (ISO/IEC 27002:2022), not the certificate.
Not a certificate. Not a gap analysis. A written, signed qualification of your existing measures. Five working days, no system access required.
- ✅ Qualification across the installation, operation and performance stages, not just a document review
- ✅ Deep dive against NIS2 Article 21(2)(a) to (j), GDPR, and a BSI-Grundschutz baseline
- ✅ Management-liability check: the personal risks of the management
- ✅ A prioritized remediation plan with effort estimates
- ✅ Delivered as a Qualification Report valid for 12 months or until the first revalidation trigger occurs
- ✅ An executive summary and a one-hour debriefing for the management
- ✅ No access to your systems required: you run the qualification protocols, I qualify the raw evidence
- ✅ Findings name the exact weak points, like untested restores or partial MFA. That is the evidence-based scenario basis for the incident tabletop exercises that audits and certifications expect.
also found as: NIS2 Audit, NIS2 examination, NIS2 gap analysis
Implementation Support
You close the gaps your Qualification Report named - and I steer the implementation until every measure passes re-qualification.
- ✅ 1–2 days/month remote
- ✅ Prioritisation and steering of the implementation
- ✅ NIS2 and GDPR measures in parallel
- ✅ Review of implemented measures
- ✅ Preparation for BSI audit
- ✅ On demand: training for board and CSIRT
- ✅ Cancelable monthly, you stop when you are done
What a Qualification Report looks like. View sample (PDF)
All results are professional qualifications by an independent expert and are not a certification, not a government audit, and not legal advice. The Qualification Report is valid for 12 months or until a material change devalues your measures. After that, you decide again.
Why not just a normal IT consultant?
IT consultants manage technology. I test and prove your security vis-à-vis authorities and auditors.
Jan Richter
Qualification expert in IT security. Methodology derived from the regulated pharmaceutical industry.
More than 10 years of IT responsibility in the strictly regulated pharmaceutical industry, with direct accountability to FDA, EMA and BSI audits. As a decision-maker I have personally owned and passed qualifications. I know from experience: when IT fails, what counts is not the excuse but the record. I bring this uncompromising perspective into your company.
I have implemented the strictest regulations in the world in practice. Now I bring this standard to your NIS2 compliance.
Frequently asked questions
How does your approach differ from ISO 27001?
ISO 27001 checks whether a management system is in place and whether policies exist. I check whether your concrete measures actually work, with execution evidence from configuration, logs and tests under pressure. The two complement each other: an ISO certification without execution evidence answers the auditor's questions only halfway.
Do I need to be affected by NIS2 for your qualification to be worthwhile?
No. The qualification answers the practical question: what do you hand over when the customer questionnaire arrives, the insurer renews, the auditor asks, or the board wants to know? NIS2, GDPR and ISO are sources of requirements, not the only trigger. Many clients use the report precisely for tenders and insurance renewals.
How long does a qualification process take?
A 30-minute scoping call. Then you run the qualification protocols in your own environment and submit the raw evidence. The report follows within 5 working days of complete receipt.
How long is the Qualification Report valid?
12 months, or until a material change occurs, such as a switch in cloud providers, the introduction of new critical systems, or an incident. The report names the triggers concretely. Then you decide whether to have the measures requalified.
Do you run security operations for us?
No. I qualify your existing measures and enable your team to do the follow-up work. After that you are free. No lock-in, no minimum term.
In which industries do you operate?
All sectors with an audit duty or an expectation of auditors: energy, health, transport, logistics, chemicals, food, digital infrastructure, IT service providers, plus regulated industry with a GxP background.
We need evidence for B2B tenders. Is this possible?
Yes. The Qualification Report is thoroughly documented and prepared for submission to business partners, procurement teams and insurers. Numerous clients use it precisely for this purpose.
Can I see a sample report first?
Yes. A complete sample with five example findings: Sample report (PDF)
Does the quick check replace a qualification?
No. It is a three-minute self-assessment: no document, no proof value. The qualification examines your measures in three stages with execution evidence; see the sample report. To the quick check
Can I get the qualification against GDPR or ISO 27001 instead of NIS2?
Yes. The obligation source does not change the method. You pick the framework your auditors, insurers or customers demand - NIS2, GDPR or ISO 27001 - and the Qualification Report traces every measure to that framework's requirements. Same fixed price, same five working days. Against ISO we qualify the 27001-relevant control requirements from ISO/IEC 27002:2022 - what the existing ISO 27001 certificate does not give you: per-measure execution evidence that your controls actually work.
Get in touch
Have questions about NIS2 compliance? I reply within 24 hours.