Solution · NIS2 & compliance

NIS2 is in force. Is your security something you can prove?

Around 30,000 companies in Germany fall under NIS2 – and executive management is personally liable. “We’re basically secure” will not satisfy any regulator. We take you from gut feeling to documented evidence.

Check your maturity in 2 minutes Book an initial consultation

What is at stake

Personal liability

NIS2 explicitly holds executive management responsible – delegation alone does not discharge that duty. What is required is demonstrable implementation.

Fines running into millions

Depending on your category, substantial penalties apply – on top of the reputational damage when an incident becomes public.

Customers demand evidence

Even suppliers outside the scope of NIS2 are increasingly asked by their customers for security evidence – compliance is becoming a competitive factor.

Free quick check

Where do you stand? 8 questions, 2 minutes.

An honest rapid test against the core requirements of Art. 21 NIS2 – anonymous until you see your result.

The solution

The route to NIS2 readiness – in five building blocks

Not a mammoth project but a structured roadmap. Each building block delivers verifiable progress.

1 · Establish asset transparency

NIS2 starts with your inventory: you can only protect – and prove – what you know about. Our own Deskcenter software records every asset automatically, creating the data foundation for everything that follows.

Our product: Deskcenter Asset Management →

2 · Determine where you stand

A cyber security assessment workshop or a compact IT health check: scope, risks and gaps, documented with a prioritised action plan.

Technical details: assessment →

3 · Implement the technical obligations

Firewall, endpoint protection, email security, MFA and tested backups – operated as managed services rather than installed once and forgotten.

Technical details: security services →

4 · Be able to detect & report

Proactive monitoring and SIEM & SOAR with use cases derived directly from NIS2 – including a reporting process that meets the deadlines.

Technical details: SIEM & SOAR →

5 · Provide ongoing evidence

Audit-ready reports, documented configuration baselines and quarterly reviews – the evidence comes from day-to-day operations, not from night shifts before the audit.

Technical details: managed services →

Why mosaic IT?

Honest advice

We also tell you what is NOT mandatory. No scaremongering, no certificate myths – just a plan that stands up to auditors.

Everything from a single provider

Assessment, implementation, operations and evidence: one contract, one dedicated contact, 200+ person-years of experience.

Evidence included

Every one of our managed services comes with the documentation built in – reports, logs and reviews that auditors accept.

In practice

What the outcome looks like

Reference project: automotive dealership group, 5 sites, approximately 450 users

Starting point: An IT landscape that had grown over time, with flat networks secured differently at each site and heterogeneous Microsoft licensing. A uniform security level could neither be substantiated nor demonstrated to customers or auditors.

Solution: WatchGuard clusters at all five sites, network segmentation, Hornetsecurity for email security, multi-factor authentication, plus WatchGuard MDR and NDR for continuous detection. mosaic IT has operated the firewalls as a managed service ever since, and Microsoft licensing was moved to CSP.

Result: A uniform, redundant security level across all five sites. Segmented networks limit spread in the event of an attack, threats are detected continuously, and operations are monitored, patched and documented audit-ready. The evidence NIS2 requires is generated in day-to-day operations.

The numbers that make the case

Cyberattacks cause around €202 billion in damage in Germany every year – part of €289.2 billion in total economic damage (Bitkom 2025) – and a third of companies have already been hit by ransomware. Set against that: a predictable monthly amount:

Without managed security With mosaic IT
Costs Unpredictable – potentially existential in the event of an incident Fixed package price per month
Evidence for the audit Night shifts and nail-biting Reports at the touch of a button, generated continuously
Response in an emergency During office hours, when someone is free Defined response times per SLA
IT team Tied up in day-to-day operations Free for value-adding projects

Frequently asked questions

Are certified training courses or specific products mandatory?
No. NIS2 requires appropriate, demonstrable measures – not a specific product or a certificate. Anyone claiming otherwise is trying to sell you something. What counts is the documentation.

When does NIS2 apply to us?
Germany’s NIS-2 Implementation Act has been in force since 6 December 2025. Whether your organisation is covered depends on its sector, size and the statutory criteria. We help determine your scope and the applicable registration, reporting and risk-management duties.

How long does the road to readiness take?
From assessment to a solid security baseline typically takes weeks, not years – the building blocks are managed services that we bring into operation quickly.

What does it cost?
Each building block has transparent package pricing (published on the service pages). After the health check you receive a specific calculation for your environment.

We already run security products – isn’t that enough?
Installed software is not the same as protection. NIS2 asks about operations: who monitors, patches, tests and documents? That is exactly the gap we close.

Further reading

Excel tool

NIS2 Self-Assessment

30 questions · live scoring · action plan

The detailed status assessment against the 10 NIS2 requirements – including a benchmark comparison.

Request the tool free of charge

From gut feeling to evidence – let’s get started

In a free initial consultation we clarify your scope, your priorities and the fastest route to readiness.

Get in touch 📞 +49 571 783484 0