NIS2 software: what it should do and what it costs
Which features NIS2 software should have, which tools you still need beside it, and what the software costs.
NIS2 software helps companies implement the EU NIS 2 Directive (2022/2555) and its national transposition, in Germany the BSIG. It covers the ten measures in Article 21(2) NIS 2 (§ 30 BSIG), plus incident reporting and registration with the authority.
What nisd2.eu does for you
One thing at a time
You only ever see one item. We explain it in plain words before you enter anything, and the law behind it is one click away.
Management approves in the app
At the end, management reads the documents the app wrote and approves them, signed in with its own account. Its name and the date then appear on each document. Nothing is printed or scanned.
The activity log
It shows, day by day, who changed what and when. Every approval by management is in it too.
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
- Guided NIS 2 implementation, step by step
- A history of changes and sign-offs to show your regulator
- Deadlines and reminders for each requirement
- Security questionnaire for your suppliers
- Export to PDF or CSV at any time
The training for management stays free, and so does self-hosting: the same source code (AGPL-3.0) on your own servers.
- § 30(1) BSIG requires you to document that you comply with the measures. Software keeps that evidence in one place.
- Significant incidents are reported in three stages: early warning within 24 hours, notification within 72 hours, final report one month after the notification (§ 32 BSIG).
- Management must implement the measures and oversee their implementation (§ 38(1) BSIG). Sign-offs in the software show who decided what, and when.
- The ten measures involve IT, purchasing, HR and management. One shared tool shows everyone the same status.
| Tool | Purpose | Legal basis |
|---|---|---|
| GRC platform | Governance, risk and compliance: measures, risks, evidence and audits in one place. | Documenting the measures (§ 30(1) BSIG) |
| Asset management | Inventory of your IT systems as the basis for risk analysis. | Mandatory (Article 21(2)(i) NIS 2) |
| SIEM / logging | Detection of security events, forensics. | Strongly recommended: detect reportable incidents |
| Patch management | Tracking updates for operating systems and applications. | Mandatory (Article 21(2)(e) NIS 2) |
| MFA / IAM | Multi-factor authentication, identity and access management. | Mandatory (Article 21(2)(j) NIS 2) |
| Backup and recovery | Data backup and the ability to restore systems. | Mandatory (Article 21(2)(c) NIS 2) |
| Supplier management | Cybersecurity assessment of your suppliers. | Mandatory (Article 21(2)(d) NIS 2) |
| Training platform | Training for all staff and for management (§ 38(3) BSIG). | Mandatory (Article 21(2)(g) NIS 2) |
- The ten measures in Article 21 NIS 2 (§ 30 BSIG)
- Incident reports in three stages (24 hours, 72 hours, one month) under § 32 BSIG
- Registration data under § 33 BSIG with a history, so you report changes on time
- History: every change with its time and the person responsible
- Management sign-offs, stored so they can be traced
- Supplier register with the status of each supplier
- Several EU countries, if you operate across borders
- Vendor lock-in: you must be able to export all your data
- No public price: ask for the annual price before the first meeting
What does NIS2 software cost?
In our May 2026 audit of 150 GRC vendors, 120 published no price. nisd2.eu publishes it: the NIS 2 walkthrough costs €4,800 net a year, plus VAT, by invoice. If you cancel your first order within 30 days, you get your money back. Self-hosting the open source code is free of charge.
Is Excel enough?
The law prescribes no tool. § 30(1) BSIG requires you to document compliance with the measures, and Excel can do that. It gets hard once several people edit the file and you later need to show who changed or approved what, and when. That is what software with a history is built for.
Is one tool enough, or do I need several?
NIS2 software covers documentation and evidence. For SIEM, patch management, MFA and backups you still need separate technical tools. The evidence from those systems then goes into the NIS2 software.
Does NIS 2 prescribe a particular software?
No. Neither NIS 2 nor the BSIG names a vendor. What matters is that you implement the measures and document compliance. Open source does that as well as bought software.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
