NIS2: Find out where you stand and what to do first.
NIS2 has applied in Denmark since 1 July 2025. We review your security against the requirements and give you a prioritised plan that management can approve and IT can work from.
- Gap analysis against NIS2
- Prioritised plan for management
- Technical testing of whether controls work
Does NIS2 apply to you?
NIS2 generally applies to medium and large companies, meaning at least 50 employees or more than 10 million euros in turnover, across a wide range of sectors: energy, transport, health, digital infrastructure, public administration, manufacturing, food, waste, postal services and digital services. Some companies are covered regardless of size. If you're unsure, we work it out with you in the first conversation.
Not covered yourself, but a supplier to a company that is? Your customers will set security requirements for you, and we help with those too.
What NIS2 requires
- Risk management: a documented assessment of your risks and the measures that cover them
- Incident handling: an early warning within 24 hours, a notification within 72 hours and a final report within a month
- Business continuity: backups, crisis management and recovery after an attack
- Supply chain security: requirements for and oversight of your suppliers
- Secure development and operations, including vulnerability handling
- Access control, encryption and multi-factor authentication
- Regular assessment of whether your security measures actually work
- Management accountability: management approves the measures, oversees them and takes part in training
How a NIS2 gap analysis works
- 01
Scoping
We establish whether and how NIS2 applies to you, which systems are business-critical and what you already have in place.
- 02
Review
We review policies, processes and technology against the requirements through interviews and documentation, and test selected controls technically.
- 03
Plan
You get a prioritised plan: what is missing, how serious it is and what to do first. Written so management can approve it.
Afterwards: close the gaps
We can also handle the technical measures: penetration testing that documents your security works, and monitoring that catches attacks in time. Read about penetration testing →
Book a no-obligation NIS2 call
Tell us briefly about your company and we'll get back to you within one business day with a suggestion for how to get started.
Frequently asked questions
Have a question that isn't covered here? Email us at info@edgetek.dk
01 When did NIS2 take effect in Denmark?
The Danish NIS2 act took effect on 1 July 2025. Companies in scope must register via Virk and meet the requirements for risk management, incident reporting and management accountability.
02 What does a NIS2 gap analysis cost?
It depends on your size and how many systems are involved. We agree a fixed price before we start, so there are no surprises.
03 Can you certify us for NIS2?
There is no actual NIS2 certification. We document your level against the requirements, and many companies use ISO 27001 as the framework. The documentation can be used with the authority, auditors and customers.
04 Is penetration testing required by NIS2?
The law doesn't name penetration testing directly, but it requires you to assess whether your security measures work. A penetration test is one of the most direct ways to document that.
05 What happens if we don't meet the requirements?
The authorities can issue orders and fines. NIS2 allows fines of up to 10 million euros or 2% of global turnover for essential entities, and up to 7 million euros or 1.4% for important entities. Management is also personally accountable for compliance.
06 We supply a company that's in scope. Does NIS2 apply to us?
Perhaps not directly, but companies in scope must set security requirements for their suppliers. Many suppliers therefore receive questionnaires and audits from customers. We help you document your level.