NIS2 Implementation Costs
What NIS2 compliance costs a mid-sized German company, and what the figures rest on.
The Cost Transparency Gap
Search for 'NIS2 implementation costs' and you'll find consultant websites that say 'it depends' and enterprise vendors who hide pricing behind sales calls. For a 100-person German company trying to budget for compliance, this is useless. You need real numbers to make real decisions.
The only official estimate is the German government's, in the bill for the NIS2 implementation act (BT-Drs. 21/1501, pp. 110 to 111). It assumes that an essential entity spends on average about 2,752 staff hours and EUR 60,700 in material costs a year on the risk management measures (§§ 30, 31 and 38(1) BSIG), figures taken from a 2020 survey of critical infrastructure operators, and that an important entity spends 60 percent less: about 1,100 hours and EUR 24,300. At the bill's average wage rate of EUR 56.08 an hour, the hours come to about EUR 154,300 and EUR 61,700. For the first year the bill adds a one-time effort of the same size as one year's. These are the government's assumptions for an average entity, made for lack of better data, not a quote for your company: the law asks for measures proportionate to an entity's risk exposure and size (§ 30(1) BSIG).
Four Ways to Get Compliant
Advantages
- Deep expertise and regulatory knowledge
- Handle complexity - appropriate for KRITIS operators
- Provide defensible external validation
Disadvantages
- Prohibitively expensive for most mid-market companies
- Knowledge leaves when the consultants leave
- Often over-engineer solutions beyond what the law requires
- Long engagement timelines
Advantages
- Comprehensive functionality for large organizations
- Integration with enterprise IT ecosystems
- Established vendor support and longevity
Disadvantages
- Require dedicated GRC staff to operate
- Massively over-scoped for a 100-person company
Advantages
- Modern UI and good user experience
- Automated evidence collection via cloud integrations
- Reasonable pricing compared to enterprise solutions
Disadvantages
- Built around SOC 2 and ISO 27001; check how the NIS2 module covers the BSIG duties (§ 30, § 32, § 38) before you buy
Advantages
- Lowest direct cost
- Full control over the process
- Internal knowledge retention
Disadvantages
- Large investment of staff time
- No structured methodology or progress tracking
- Spreadsheet-based evidence is hard to maintain and audit
| Entity type | One-time (first year) | Per year |
|---|---|---|
| Important entity (average) | Assumed equal to one year's effort | about 1,100 staff hours + EUR 24,300 material costs |
| Essential entity (average) | Assumed equal to one year's effort | about 2,752 staff hours + EUR 60,700 material costs |
- The 49 NIS 2 requirements of the walkthrough, with German law (BSIG) as the reference text
- The walkthrough writes the documents from your company-specific answers, so policies do not start from a blank page
- Management approves the documents in the app, and the approval is recorded with its date
- Progress tracking across all 12 compliance categories, in place of spreadsheets
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
