Cyber-Management
EN / FRbook a consultation

NIS2 Scope & Gap Sprint

Fixed price · 15 days

Your NIS2 scope and gaps, settled in fifteen days.

Before anyone can size a NIS2 programme, four questions need a clear, documented answer. The Sprint answers them at a fixed price set by your size alone, and you keep the documents whatever you decide next. It is a first step, not a commitment to a programme.

book a free 25-minute consultationsee the price bands

The call comes first: we tell you whether the Sprint is the right first step for you.

The four answers

Four questions come before any NIS2 programme.

Directive (EU) 2022/2555

  1. 01

    Are we in scope?

    Sector mapping against Annexes I and II, the size test on your aggregated enterprise, the size-independent categories, and a DORA screen for financial entities.

  2. 02

    Essential or Important?

    Your Article 3 classification, with the reasoning written down rather than assumed.

  3. 03

    Must we register — where, and by when?

    Your registration position in each Member State concerned, including what to prepare where national transposition is still pending.

  4. 04

    Where are our gaps, and what comes first?

    Your maturity against the ten Article 21(2) measures, scored 0 to 5, with the top gaps ranked.

What you get

Five deliverables, fifteen business days.

What you receive

  • Scope Determination

    Your scope and classification, with the reasoning documented so your management body can sign it off and explain it if your authority asks.

  • Article 21 gap analysis

    A workbook scoring your maturity in each of the ten measure categories, from 0 to 5.

  • Board-ready report

    Your top gaps ranked as your priority list, with recommended next steps.

  • Registration position

    Where you must register and what to file. You file; we advise.

  • Restitution meeting

    Sixty minutes with your management body to walk through the findings.

How the fifteen days run

  1. Day 1

    Kick-off

    A 60-minute kick-off with your executive sponsor and IT or security lead. We send the document request and book the interviews and the restitution.

  2. Days 1–5

    Evidence and interviews

    Your documents come back within three business days; interviews run in the first week.

  3. Days 6–10

    Analysis

    Scope screen, classification, registration position and Article 21 scoring.

  4. Days 11–13

    Report and review

    You receive the draft pack and return one consolidated round of comments.

  5. Days 14–15

    Delivery and restitution

    Final pack delivered, then the restitution to your management body.

What we need from you: an executive sponsor, your documents within three business days, and three to six people available for interviews in the first week. If documents or interviews slip, the calendar moves with them.

Pricing

Three sizes, one fixed price each.

Same scope and deliverables in every band. Your band is set by your headcount, not chosen, and the outcome never moves the price: sector, urgency, and whether you turn out Essential or Important make no difference.

  • Core

    Under 100 staff

    €4,900excl. VAT

  • Plus

    100 to 249 staff

    €6,900excl. VAT

  • Extended

    250 to 499 staff

    €8,900excl. VAT

  • Above 499

    500 staff and more

    On quotation

  • Headcount is your aggregated enterprise, including partner and linked enterprises: the same figure the NIS2 size test uses.
  • Up to two Member States included. Each further one is quoted before you sign.
  • Invoiced 50% at signature and 50% on delivery. No hourly billing, no urgency surcharge.

If you continue

The full fee is deducted.

100% of the Sprint fee is deducted from a NIS2 programme, vCISO or ISO 27001 engagement signed within 60 days of the restitution. Continue into the NIS2 programme and the Sprint becomes its Phase 1: nothing is done or paid twice.

If you are out of scope

You still have something to show.

The Sprint is complete either way. You get the out-of-scope conclusion documented, plus an Article 21 baseline for the NIS2-covered customers who ask you for supplier assurance.

Fit

Who the Sprint is for.

A good fit

  • Leadership teams of SMEs and mid-caps that may fall under NIS2 and want a documented answer before committing to a programme.
  • Organisations whose classification is uncertain: a group structure, a borderline sector, or operations in several Member States.
  • Suppliers whose NIS2-covered customers already ask them to show NIS2 alignment.

Not the right first step

  • Financial entities under DORA. NIS2 gives way to DORA there; see our DORA service.
  • Clients with an active vCISO engagement. NIS2 scoping is already part of it.
  • Organisations clearly outside NIS2. If the free call shows that, we tell you, and we do not sell you a Sprint to confirm it.

FAQ

Questions before you book.

What happens on the free 25-minute call?
We check your sector and size and tell you which first step fits: the Sprint, the full NIS2 programme when your classification is already clear and budgeted, or nothing at all if you are plainly out of scope. If the Sprint fits, you receive a written proposal within two business days. The proposal is also the contract, signed electronically, with no separate engagement letter.
Is the price really fixed?
Yes. The band price is the price: no hourly billing, no discount, no urgency surcharge. The only additions are agreed before you sign (a third or further Member State) or made at your request: on-site meetings with travel at cost, or a review round beyond the one included.
What happens after the Sprint?
At the restitution we recommend a next step, and you decide. There is no obligation to continue, and the documents are yours either way. If you are in scope, the natural next step is our NIS2 programme: a remediation plan and policy set (Phase 2), implementation support including management-body training (Phase 3), and a readiness review (Phase 4). The Sprint counts as Phase 1, so the programme starts at Phase 2 and nothing is redone. It is quoted as one fixed fee based on what the Sprint established, and 100% of the Sprint fee is deducted from it if you sign within 60 days of the restitution. The same deduction applies if you choose a vCISO or ISO 27001 engagement instead, which is the usual route when the Sprint concludes you are out of scope.
We have a deadline. Can it go faster?
There is no express version. Fifteen business days is the commitment for every client, and it holds when your documents arrive within three business days and interviews happen in the first week. If those slip, the calendar moves with them.
Do you register us with the authority?
No. The Sprint gives you your registration position for each Member State concerned and what to file; your organisation files. If you continue into the NIS2 programme, registration support is part of it.
What is not included?
Policy drafting, a remediation or risk-treatment plan, supplier assessments, technical testing and legal opinion. The Scope Determination is a regulatory analysis, not legal advice; where a classification is borderline, we recommend your legal counsel reviews it.

Next step

Not sure the Sprint is the right first step?

That is what the free call is for. Twenty-five minutes, no obligation: we tell you whether you need the Sprint, the full programme, or nothing yet.

book a free 25-minute consultation

Prefer to check on your own first? Try the free NIS2 readiness scorecard.

  • Senior-led

    Delivered by a practitioner holding CISSP and ISO/IEC 27001 Lead Auditor certifications.

  • Fixed scope, fixed fee

    No hourly billing and no scope creep.

  • English or French

    Delivered natively in both languages.