Your NIS2 Roadmap — From Where You Are to Where You Need to Be
The directive is in force. But not being ready yet is not the same as being non-compliant. What regulators want to see is a documented NIS2 roadmap and evidence you're working it. We help smaller organisations build that plan — and execute it, step by step.
Most Organisations Haven't Started Yet. That's Not the Problem.
The problem is doing nothing. Regulators know that full compliance takes time — especially for smaller organisations without dedicated security teams. What they do not accept is inaction: no assessment, no plan, no evidence of effort.
Organisations that can demonstrate a documented, active NIS2 compliance roadmap are in a fundamentally different position than those who can't. A roadmap is not just a project plan. It is your first line of defence if an authority comes knocking.
What is a NIS2 compliance roadmap? A NIS2 compliance roadmap is a formal, documented plan that maps your organisation's current security controls against the ten Article 21 requirements, identifies every gap, prioritises remediation actions, and assigns clear timelines and ownership. It is the document you show to a regulator as evidence that cybersecurity risk is being actively managed at board level — and it is the first thing an authority will ask for.
The NIS2 Compliance Roadmap — Four Steps Forward
You don't need to solve everything at once. You need to know where you stand and start moving. Here's how the journey works.
Find Out If You're In Scope
Not every SME falls under the directive — but many do, and some don't know it yet. Your sector, size, and role in critical supply chains all affect your obligations. Step one is getting a clear answer, so you're building on solid ground — not assumption.
See Exactly Where You Stand
A structured gap assessment measures your current controls against all ten Article 21 requirements. No guesswork. You get a clear picture of what's in place, what's missing, and what's at risk — in plain language your board can act on. This is also the document that demonstrates active NIS2 compliance effort to regulators.
Close the Gaps, In the Right Order
Not everything needs to happen at once. A prioritised remediation plan tells you what to fix first, what can wait, and what you already have covered. Progress — not perfection — is what compliance looks like in practice. We stay with you through implementation, not just the report.
Stay Compliant as Things Change
This is not a one-time project. Your threat environment, your suppliers, and your systems all change. Ongoing monitoring keeps your NIS2 compliance posture current — and keeps you in a position to demonstrate that to authorities at any time.
NIS2 Fines — What's at Stake If You Do Nothing
NIS2 fines are not theoretical. Enforcement is active in the Netherlands since July 2025 — and the penalties go well beyond a financial hit.
Energy, healthcare, transport, digital infrastructure
Fines up to €10 million or 2% of global annual turnover — whichever is higher. These are the NIS2 maximum penalties for the most critical sectors.
Most in-scope SMEs fall here
Fines up to €7 million or 1.4% of global annual turnover — whichever is higher. For a mid-sized business, this is an existential number.
Personal liability for management
Under Article 20, directors and senior management can be held personally accountable for cybersecurity failures. A documented roadmap protects the individual — not just the company.
A compliance assessment typically takes 2–4 weeks and immediately produces the documented roadmap that shifts your position with regulators — even before a single gap is closed.
Two Ways We Help You Get There
Whether you're just finding your feet on compliance or ready to bring in specialists — we have the right starting point for where you are now.
📋 NIS2 Compliance Checklist
Work through all ten Article 21 requirements at your own pace. Identify gaps, understand your obligations, and build a picture of where you stand — before talking to anyone.
- All 10 compliance areas covered
- Yes / Partial / No scoring
- Includes downloadable 2026 workbook
- Free — no registration required
🔍 NIS2 Assessment
A structured gap assessment delivered by Magic Stone and GRSee. You get a formal gap report, a prioritised remediation roadmap, and documented evidence your organisation is taking the directive seriously.
- Formal gap analysis against Article 21
- Prioritised remediation roadmap
- Documented compliance evidence for authorities
- Implementation support included
Magic Stone handles the technical controls — ransomware protection, email security, endpoint protection, backup, network security, supply chain risk management. GRSee leads the compliance assessment, governance framework, and readiness validation. Together, we give you both the regulatory standing and the operational security the directive requires.
See what an NIS2 Assessment involves →
Frequently Asked Questions
Is it too late to start NIS2 compliance?
It's not too late to start — but every week of inaction increases your exposure. Starting a formal assessment now gives you a documented compliance posture immediately. Regulators treat organisations with an active, written roadmap very differently from those with no evidence of effort. The sooner you begin, the stronger your position.
How long does it take for an SME to get compliant?
The initial gap assessment takes 2–4 weeks. Closing the most critical gaps typically takes 2–3 months for an SME starting from a reasonable baseline. Some controls — MFA, email security, backup — can be implemented quickly. Others, like governance frameworks and supply chain risk management, take longer. We help you sequence it so the highest-risk issues close first.
What does a NIS2 compliance roadmap look like?
A NIS2 compliance roadmap is a formal, documented plan that maps your current controls against Article 21 requirements, identifies every gap, prioritises remediation actions, and assigns timelines and ownership. It is the document you show a regulator as evidence that cybersecurity is being actively managed at board level. Our assessment produces this deliverable — it is compliance evidence, not a PowerPoint summary.
Do we need a consultant, or can we do this ourselves?
You can start yourself — our NIS2 Compliance Checklist is built for exactly that. But for a formal gap report and documented evidence that satisfies regulatory scrutiny, you need a structured assessment. Self-assessments are good for orientation; a formal assessment is what holds up when an authority investigates.
We already have ISO 27001 — does that help?
Significantly. ISO 27001 overlaps heavily with the directive's requirements — particularly in governance, risk management, and technical controls. We map your existing certification against your obligations so you're not duplicating effort. Most certified organisations are much closer to full compliance than they realise. The gap is usually in incident reporting timelines, supply chain documentation, and sector-specific requirements.
Are SMEs really being fined for non-compliance?
Enforcement is active. In the Netherlands, the directive entered into force in July 2025 through the Cybersecurity Act. Authorities can audit, investigate, and fine at any time — not just following an incident. Essential entities face fines up to €10 million or 2% of global turnover. Important entities — where most SMEs fall — face fines up to €7 million or 1.4%. And under Article 20, management can be held personally liable. The question is not whether enforcement will happen — it's whether you're ready when it does.
Related
Ready to Find Your Footing?
Book a 45-minute call with Magic Stone. We'll tell you whether you're in scope, where your biggest risks are, and what your compliance roadmap looks like. No jargon. No pressure. Just clarity.
Book Your Free NIS2 Call
