THREAT-WATCHCOMPLIANCE CONSULTING
NIS2 & ISO 27001 Readiness
We guide you through NIS2 and ISO 27001 requirements, documentation, and implementation, and cover GDPR, SOC 2, NIST CSF, CIS Controls and PCI DSS too, so compliance is a byproduct of good security, not a separate scramble.
What you get
NIS2 applies to a specific, defined set of essential and important entities across sectors including energy, transport, banking, health, digital infrastructure, manufacturing of certain products, and public administration. We help you determine whether and how it applies to you, then build toward ISO 27001-aligned controls for your information security management system (ISMS) and NIS2 obligations together, since the two overlap significantly.
Applicability assessment
We assess whether your organization falls under NIS2 as an essential or important entity, and what that actually requires of you.
Gap analysis
We map your current controls against ISO 27001 and NIS2 requirements to show exactly what's missing before an auditor does.
Documentation support
Policies, risk assessments, and evidence packages are built in the format auditors and regulators expect.
Implementation guidance
We don't just hand you a checklist. We help implement the technical and organizational measures the standards require.
24-hour reporting support
From the moment a significant incident is identified, we assemble and draft your Article 23 early warning so it can go out inside the 24-hour window. The obligation and sign-off remain yours; the drafting is ours.
Beyond NIS2 and ISO 27001
We also prepare you for GDPR, SOC 2, NIST CSF 2.0, CIS Controls v8 and PCI DSS, and for US frameworks such as HIPAA and CMMC if you sell into the US. Evidence is mapped across frameworks, so work done for one counts toward the others instead of starting from zero each time.
How a NIS2 and ISO 27001 engagement runs
Compliance work fails when it produces documents nobody uses. Ours follows five stages, each ending in something you can show to your board, an auditor or the authority.
Applicability and classification
We establish whether NIS2 applies to you under Greek Law 5160/2024 (or the law of the other member states you operate in), whether you would be an essential or an important entity, and whether you are reached indirectly as a supplier to in-scope customers.
Gap analysis
We map your current controls against the ten Article 21 risk-management measures and the ISO 27001 requirements, so you see exactly what is missing and what is already good enough.
Prioritized roadmap
Gaps become a roadmap ordered by risk and effort, with owners and realistic sequencing. Your management body can approve it, which is itself an Article 20 requirement.
Implementation and evidence
We help put the measures in place: policies, risk assessments, an incident-handling and reporting procedure, supplier security requirements and the technical controls behind them. Evidence is mapped across frameworks, so work done once counts toward NIS2, ISO 27001 and GDPR together.
Staying compliant
Compliance is maintained, not achieved once. We support periodic reviews, management briefings, incident reporting when it is needed and, if you pursue it, readiness for the ISO 27001 certification audit.
What is covered, and what is not
Covered
- NIS2 applicability and essential/important classification assessment
- Gap analysis against Article 21 and ISO 27001
- Policies, risk assessments, incident and reporting procedures, supplier security requirements
- Drafting support for Article 23 reports when an incident happens
- Management-body briefings and preparation for the ISO 27001 certification audit
- Cross-framework evidence mapping (GDPR, SOC 2, NIST CSF 2.0, CIS Controls v8, PCI DSS)
Not covered
- Formal legal opinions. We work alongside your counsel on questions that need one.
- Issuing ISO 27001 certificates, which only an accredited certification body can do.
- Taking over your legal reporting obligation. Reports are filed in your name and stay legally yours.
NIS2 in Greece: the practical essentials
Greece transposed NIS2 through Law 5160/2024. The National Cybersecurity Authority (NCSA, Εθνική Αρχή Κυβερνοασφάλειας) is the competent authority and single point of contact. This is what that means in practice.
Who is in scope
As a rule, medium and large organizations in the sectors listed in Annexes I and II of the Directive: 50 or more employees, or both annual turnover and balance sheet above €10M. Some entities are covered regardless of size, such as certain digital infrastructure providers and public administration bodies as the law defines them. Group structure and the details of the Greek law can change the answer, so confirm your specific case with the NCSA or your counsel.
Essential or important
Large organizations in Annex I sectors are generally essential entities; medium Annex I organizations and Annex II organizations are generally important entities. Essential entities face proactive supervision, while important entities are supervised mainly after the fact, for example following an incident or a complaint.
Registration with the NCSA
In-scope entities must register with the NCSA and keep the information they submit up to date. Registration is usually the first concrete step, because it is how the authority knows you exist. Check the NCSA’s current guidance for the process and any deadlines that apply to you.
Reporting under Article 23
For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification with an initial assessment within 72 hours, and a final report within one month of the notification, with intermediate updates if the authority asks. The clock starts at awareness, not at the end of the investigation.
Fines
Essential entities: up to €10M or 2% of total worldwide annual turnover, whichever is higher. Important entities: up to €7M or 1.4%, whichever is higher. These are the Directive’s ceilings, which Greek law follows; the actual amount depends on the case.
Management-body accountability (Article 20)
The management body must approve the cybersecurity risk-management measures, oversee their implementation and follow training, and its members can be held accountable for non-compliance. NIS2 is a board topic, not only an IT project.
Duties for suppliers of in-scope entities
Even if you are not in scope yourself, Article 21 requires your in-scope customers to manage supply-chain security, including their direct suppliers and service providers. Expect security questionnaires, contract clauses, incident-notification duties and audit rights. Having ISO 27001-aligned controls and evidence ready turns these requests into routine paperwork instead of a risk to the contract.
NIS2 in Cyprus
In Cyprus, NIS2 applies through the Security of Networks and Information Systems (Amendment) Law of 2025 (Law 60(I)/2025), which amends Law 89(I)/2020. The competent authority is the Digital Security Authority (DSA). The core obligations come from the same Directive, so expect the Article 21 measures, the Article 23 reporting stages and management-body accountability, but registration procedures, supervisory practice and penalty details are set nationally. Cyprus-based companies should confirm the specifics with the DSA or their counsel. We support clients in Cyprus with the same approach we use in Greece.
How THREAT-WATCH services map to Article 21
Several of the ten Article 21 measures are operational, not documentary, and that is where a managed security services provider helps most. Incident handling is covered by 24/7 SOC monitoring, MDR and incident response. Business continuity and backup management are covered by backup and disaster recovery. Cyber hygiene and training are covered by phishing simulation and staff training. Assessing the effectiveness of your measures is supported by gap reviews and, on higher plans, red team exercises through vetted partners. Policies, risk analysis, supply-chain requirements and access control are what this compliance service builds with you, so the documents describe controls that actually run.
Which plans include compliance support
Compliance support is included from THREAT-WATCH Gold, which also brings a quarterly review with our CEO. Platinum adds a board-ready pack for your management body. Bronze and Silver clients still get monitoring and incident documentation that supports reporting, and can move to Gold when compliance work becomes a priority.
Compare plans →FAQ
Does NIS2 apply to my business?
NIS2 applies to essential and important entities in specific sectors (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, and certain manufacturing, among others), generally above defined size thresholds. We can assess your specific case.
Who actually files the NIS2 24-hour report, you or us?
We do the work: our SOC detects the incident, assembles the early-warning content, and prepares the Article 23 submission so it can go out inside the 24-hour window, so you are not drafting a regulatory notification during an active incident. What we cannot do is take on the obligation itself. Article 23 places the duty on the in-scope entity, and that liability is not delegable to a provider, so the filing is made in your name and stays legally yours. In practice this means we handle the drafting; you keep sign-off and remain the accountable party to the authority.
How is NIS2 different from ISO 27001?
NIS2 is an EU legal obligation with specific incident-reporting deadlines and penalties; ISO 27001 is a voluntary certifiable standard. In practice, ISO 27001-aligned controls cover most of what NIS2 technically requires, which is why we address them together.
Which other frameworks do you support?
Alongside NIS2 and ISO 27001, we support GDPR, SOC 2, NIST CSF 2.0, CIS Controls v8 and PCI DSS. For clients that sell into the US, we also cover frameworks such as HIPAA and CMMC. If you need one that is not listed here, ask us; the list is longer than what fits on this page.
Do you provide the ISO 27001 certification itself?
Certification is issued by an accredited external certification body. We prepare your organization to pass that audit. We don't issue the certificate ourselves.
Is there such a thing as NIS2 certification?
No. NIS2 is a legal obligation, not a certifiable standard, so no one can certify you as NIS2 compliant. You demonstrate compliance to the authority through your measures and evidence. ISO 27001 certification is separate, but it is strong supporting evidence because the controls overlap heavily.
We are below the size thresholds. Can we ignore NIS2?
Not necessarily. Some entities are in scope regardless of size, and if you supply an in-scope organization, its supply-chain obligations will reach you through contracts. Check both before deciding NIS2 is not your concern.
Who supervises NIS2 in Greece?
The National Cybersecurity Authority (NCSA), under Law 5160/2024. In-scope entities register with the NCSA and report significant incidents according to Article 23. Check the authority’s current guidance for procedures and deadlines.
How large can NIS2 fines be in Greece?
Up to €10M or 2% of worldwide annual turnover for essential entities, and up to €7M or 1.4% for important entities, whichever is higher in each case. Our free NIS2 checklist includes a calculator that estimates your exposure.
Are directors personally accountable under NIS2?
Article 20 requires the management body to approve and oversee the risk-management measures and to follow training, and its members can be held accountable for non-compliance. For essential entities, authorities can go as far as temporarily barring a person from managerial functions until the entity complies.
Do you support companies in Cyprus?
Yes. In Cyprus, NIS2 applies through Law 60(I)/2025, which amends Law 89(I)/2020, with the Digital Security Authority (DSA) as the competent authority. The working method is the same as in Greece; national procedures should be confirmed with the DSA or your counsel.
Related Services & Resources
Not sure if NIS2 applies to you?
Tell us about your organization and we'll help you figure out where you stand.