Cookies on AIGROW

We use necessary cookies to run the site. With your permission, we also use cookies for analytics, session recordings and marketing attribution.

Cookie Policy

NIS2 readiness pack: a scope check, a gap report against the ten security measures of Article 21 and your starter policies, written from your answers within 10 working days

$990Fixed price, paid onceWithin 10 working days of your answers

Order for $990How it works

Every finding cites its article. Not delivered as listed, refunded in full.

AIGROW prepares your NIS2 readiness pack for $990, paid once: a check of whether Directive (EU) 2022/2555 covers your company and as what, a gap report marking each of the ten security measures of Article 21(2) in place, partial or missing, a starter policy set written from your facts and a one-page summary for your management body.

What the NIS2 readiness pack does, and what it does not

The NIS2 Directive sets security duties for medium-sized and larger companies in the sectors it lists, among them cloud computing, data centres, managed IT and managed security services, and each EU country applies it through its own law. The companies it covers must also manage the security of their direct suppliers, so smaller suppliers receive its requirements from their customers.

What it does
  • Checks whether NIS2 covers your company from your sector, your size and the EU country where you are established, and states the result: essential entity, important entity or not in scope, with the reasoning
  • If you are in scope, gives the registration steps and the national authority for your country, from the law in force on the day we deliver
  • Marks each of the ten measures of Article 21(2) in place, partial or missing, from the documents and answers you give
  • Writes starter policies from your facts: information security and risk analysis, incident handling, business continuity and backup, supply chain security, access control and multi-factor authentication, cryptography, vulnerability handling and staff training
  • Writes the incident notification procedure to the deadlines of Article 23: an early warning within 24 hours, a notification within 72 hours and a final report within one month
  • Sums up the result on one page for your management body, which under Article 20 approves the measures and must follow training
What it does not do
  • It is not legal advice and we are not a law firm: we prepare the scope check and the documents from your answers and the published texts, and your own counsel or the national authority has the final word on scope
  • It is not a certification or an audit: we do not test your systems, and the gap report rests on the documents and answers you give
  • It does not make you compliant on its own: the policies set rules, and putting them in place is up to you
  • It does not register you or file incident reports for you: the pack gives the steps and says who does them
  • It does not keep your answers: they are deleted 30 days after delivery

From payment to the finished pack

Each step and when it happens. Everything is done in writing: there is no call, and we never ask for a password.

Pay at checkoutPay once by card at the Stripe checkout. Stripe sends the receipt.2 minutes
Answer the written questionnaireWe email you the questions straight after payment. Attach the security documents you have and any requirements a customer sent you. A question you cannot answer yet is marked in the pack, never guessed.By email
We check scope and write the packWe read your answers against the Directive and the national law in force on the day, decide the scope, mark each measure of Article 21(2) from your documents, and write the policies and the summary from your facts.Within 10 working daysAfter your complete answers
Review it and ask for changesRead the pack, with your counsel where the scope is unclear, and send us your notes. We make one round of revisions.One round
Put the policies to workYour management body approves the measures, and your team applies the policies and closes the gaps. The files are yours to edit.When you choose

One company, one fixed price

Paid once at checkout, which asks for your email and card. Right after payment we email you the written questionnaire, and the pack comes back as editable files within 10 working days of your complete answers.

What we need from you

Reply to our written questionnaire: your company and the EU countries where it is established and provides services, what you sell, your head count, turnover and balance sheet total, any NIS2 requirements a customer sent you, who sits on your management body, and the security documents you already have.

What you receive

  • The scope check: essential, important or not in scope, with the reasoning, and if you are in scope, the registration steps and the authority for your country
  • The gap report: each of the ten measures of Article 21(2) marked in place, partial or missing, with the document or answer behind each mark
  • Starter policies for information security and risk analysis, incident handling with the notification procedure, business continuity and backup, supply chain security, access control and multi-factor authentication, cryptography, vulnerability handling, and training, including the management body training of Article 20
  • A one-page summary for your management body
  • Word and Google Docs files that you own and can edit
  • One round of revisions after you read the pack

NIS2 readiness pack

$990

Paid once at checkout. No subscription, nothing renews.

If we do not deliver what this page lists, or you change your mind before work starts, you get a full refund.

Why buy it from AIGROW

What you can check before you pay, and after the work.

A fixed price
$990, paid once. No subscription, nothing renews. Everything included is listed on this page before you pay.
Proof you can check
Each line of the gap report cites its point of Article 21(2) and names the document or answer it rests on, so you can check every finding against your own files and the Directive on EUR-Lex.
A public method
Article 21(2)(e) asks for vulnerability handling and disclosure. The free security.txt checker reads the file on your site that tells researchers where to report a vulnerability, against RFC 9116, the same check we run for that line of the gap report. Run the security.txt checker

Before you buy

Who NIS2 covers, what it asks for, what the pack leaves to you and what happens to your answers.

It covers companies of a type listed in Annex I or II of the Directive that are medium-sized or larger and provide their services in the EU. Medium-sized or larger means 50 or more staff, or an annual turnover and a balance sheet total both above 10 million euros, counted together with the partner and linked companies in your group. Some types, such as DNS service providers, top-level domain registries and trust service providers, are covered whatever their size.

Cloud computing service providers, data centre service providers, managed service providers and managed security service providers are all listed in Annex I, and the Directive names software as a service among the cloud computing service models. For these providers, the country that supervises you is the one where your decisions on cybersecurity measures are mainly taken. The scope check sets your services against these definitions.

It can be. Under Article 21(2)(d), the companies NIS2 covers must manage the security of their supply chain, including their direct suppliers, so they send security requirements to suppliers the Directive does not cover. The scope check may find that you are not in scope. The pack then becomes the evidence set those customers ask for: written policies and a gap report you can show them.

Policies on risk analysis and information system security; incident handling; business continuity, such as backups and disaster recovery, and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; assessing whether the measures work; basic cyber hygiene and training; cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor authentication and secured communications, where appropriate.

Under Article 23, a significant incident is reported to your CSIRT or national authority in stages: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report no later than one month after the notification. The procedure in the pack says who decides, who reports and what each report contains. To have a full incident response plan written and then tested with your team, the incident response plan with a tabletop exercise does that for $690 paid once.

Under Article 20 it approves the security measures, oversees how they are put in place and can be held liable for breaches, and its members must follow training. The one-page summary gives it the scope result and the main gaps, and the training policy covers its own training.

It depends on your country, and the scope check gives the steps for yours. In Italy, under Legislative Decree 138/2024, companies register on the platform of the National Cybersecurity Agency (ACN) every year between 1 January and 28 February. In Germany, the BSI Act requires registration with the Federal Office for Information Security (BSI) within three months of first qualifying, through the BSI's portal.

EU countries had to adopt their laws by 17 October 2024 and apply them from 18 October 2024, and they did so at different times. On the day we deliver, we check the law in force in your country and the pages of its authority, and the scope check cites them. Where a national law is not yet in force, the scope check says so and works from the Directive.

For breaches of Article 21 or 23, each country must allow fines on essential entities of up to at least 10 million euros or 2% of total worldwide annual turnover, whichever is higher, and on important entities of up to at least 7 million euros or 1.4%, whichever is higher. The national law sets the exact amounts.

No. We prepare the scope check and the documents from your answers and the published texts. We are not a law firm, and we do not test your systems or certify anything. Your own counsel or the national authority has the final word on scope, and the pack does not make you compliant on its own.

Your answers are read by AI models whose providers are in the United States, under commercial terms where the provider does not train on them, and AIGROW does not train AI models on your data. These transfers follow the Standard Contractual Clauses adopted by the European Commission in 2021, which our data processing agreement includes. We delete your answers, any documents and our working files 30 days after delivery, or sooner if you ask.

Within 10 working days of your complete answers. If an authority or a customer needs the pack sooner, email hello@aigrow.gg before paying and we tell you whether we can meet the date.

If you also make software or connected devices

The Cyber Resilience Act sets a separate reporting duty for products with digital elements, which applies from 11 September 2026. Our Cyber Resilience Act kit writes that procedure, a disclosure policy, security.txt and a software bill of materials.

See the Cyber Resilience Act kit

The service that fits next

From $290

Security questionnaire answers

We answer the security questionnaire a customer sent you from your own documents, with the source of every answer and the questions only you can answer marked.

See the security questionnaire service

Know where you stand on NIS2, in writing, before a customer or an authority asks.

Pay once, answer the written questionnaire, and receive the scope check, the gap report, your starter policies and a summary for your management body within 10 working days.

Order for $990See every done-for-you service

$990 · paid once · delivered as listed or refunded