NIS 2 Compliance & Incident Readiness Germany

Tool and service

NIS2Steps is the tool we use to record the current state in a structured way, to version evidence, and to make the result traceable. The assessment, the judgement and the conversation about it are the SKOPION Intelligence service. A tool replaces neither the review nor confirmation by an authority.

How it runs

1. 01First conversation: scope, the unit assessed, the timeframe.
2. 02Collection: questions along the requirements, each answer marked as evidenced or declared.
3. 03Evidence: documents are recorded with versions, not reviewed once and forgotten.
4. 04Analysis: gaps, open questions, priorities and next steps.
5. 05Discussion: we go through the result with you and record what comes first.

What you receive

• A documented scope assessment, with the reasoning behind it.
• Requirement, declaration and available evidence set side by side.
• A named list of open questions — explicitly separate from evidenced findings.
• Prioritised actions with a time horizon.
• A report in German, English or Polish.

What this is not

• Not a certification and not a confirmation of conformity.
• Not legal advice; national transposition is judged by a qualified person.
• Not a result derived from a domain or a short questionnaire alone.
• The language of the interface does not select a jurisdiction.

Frequently Asked Questions About NIS 2 Readiness

Which organizations are affected by the NIS 2 Directive in Germany?

Organizations with 50+ employees or €10M+ annual turnover across 18 critical and important sectors, as well as digital suppliers and IT service providers in their supply chains.

What are the management liabilities under NIS 2?

Corporate directors face direct personal liability for approving cybersecurity risk measures, must undergo regular training, and must adhere to strict 24-hour incident notification deadlines.

How does SKOPION conduct a NIS 2 readiness assessment?

We benchmark your security baseline against the 10 statutory risk management requirements, document governance gaps, and deliver an actionable incident readiness roadmap.