How much NIS2 compliance costs: pre-implementation, implementation and audit

One of the first questions of any company covered by NIS2 is simple: how much does compliance cost? The honest answer is that there is no single price, and the biggest source of confusion is that people mix two phases that are very different in effort and in budget. We separate them clearly in this article, break down each cost component and show what you can do for free before you pay.

The two phases of NIS2 compliance

Compliance is not a single project, but two consecutive phases, with very different costs:

1. Pre-implementation. You find out where you stand and what you have to do: classification, the initial risk analysis, the maturity self-assessment on the CyFun framework and the implementation plan. This phase is, for the most part, free.
2. Implementation. You actually put the controls in the plan into practice: processes, technical measures, security tools and evidence. This is where the most significant costs appear, followed by the external audit.

Most wrong estimates come from mixing the two: the consultancy that helps you at the self-assessment and at the plan is not the same thing as the effort and cost of implementing the controls. We treat them one at a time.

The pre-implementation phase: mostly free

In the Certudo platform you go through, for free and with no card, the steps that give you the full picture:

• Classification under NIS2 and the level (essential or important), with the classification and registration tool.
• The initial risk analysis, following the DNSC methodology, with the risk analysis tool.
• The CyFun maturity self-assessment on the six functions, with a score against the target level.
• The implementation plan, prioritised by risk, ready to put into practice.

The only optional cost in this phase is the consultancy, if you want a Certudo specialist alongside you at the self-assessment and at building the plan. This is the pre-implementation consultancy, not the one at the actual implementation:

These prices cover the assistance at the CyFun maturity self-assessment (the initial audit, also called the gap analysis) and at building the implementation plan. The self-assessment and the plan remain free in the platform regardless of level; you pay only if you choose to be accompanied by a specialist in this phase. The price difference between levels reflects the real effort: an essential entity has more CyFun controls and higher maturity requirements than an important or basic one.

The implementation phase: this is where the big costs appear

Once you have the plan, the part where you put the controls into practice follows. Here the budget is, as a rule, the most substantial and is made up of several elements:

• The implementation effort. People in the organisation dedicate time to creating the processes, applying the measures and collecting the evidence. Many companies also bring in an implementation consultant or a NIS2 officer, or a vCISO service (security officer as a service), who coordinates putting it into practice. This is a different role from the consultancy at the self-assessment.
• Security tools and software. Some of the CyFun controls are implemented with technical tools: multi-factor authentication, identity and access management, encryption, backups, monitoring and detection, vulnerability management. These tools have their own licensing cost, separate from any consultancy.
• Technical consultancy for implementing the tools. Choosing, configuring and correctly integrating these tools often requires dedicated technical expertise. It is a cost distinct from the process consultancy and from the compliance platform.
• The compliance platform. A platform such as Certudo keeps the registers, the evidence and the plan up to date, in a single place, throughout implementation and maintenance.
• The external audit. After implementation, the compliance audit is performed by DNSC-attested cyber security auditors. It is a separate stage, with its own cost. More in how to choose a DNSC-attested NIS2 auditor.

The factors that influence the cost

Two companies in the same sector can have very different budgets. Here is what makes the difference:

• The classification level (essential vs important). An essential entity has more CyFun controls to implement, a stricter audit deadline and higher maturity requirements. An important entity has a smaller set. If you are not sure where you stand, first go through essential or important entity.
• Size and complexity. An organisation with several locations, systems and suppliers has more controls to cover, more tools to integrate and more evidence to collect than a small one.
• Current maturity. If you already have a security management system (for example aligned with ISO 27001) and some of the tools installed, the gap to implement is small. If you start from scratch, both the effort and the cost of tools are greater.
• The sector. Some sectors have specific technical requirements or a higher degree of regulation, which can increase the effort and the number of tools needed.

What you can do for free before any cost

You get most of the clarity for free, in the pre-implementation phase:

• Classification. You find out whether you fall under NIS2 and at what level, through the classification and registration tool.
• Risk analysis. You go through a risk analysis that confirms the CyFun level you fall into.
• The CyFun maturity self-assessment. You see where you stand against the maturity target of 3 out of 5.
• The implementation plan. From the gap between the current and the expected state results a plan prioritised by risk, with the list of controls to implement.

Only with the plan in front of you can you realistically estimate the cost of the implementation phase: how many tools you are missing, what you can do with the internal team and where you need technical consultancy. This way you do not pay for uncertainty, but for the effort that really brings value, and the budget follows real progress.

How to think about the budget in relation to risk

The compliance budget should not be viewed in isolation, but in relation to the risk it covers. Under OUG 155/2024, approved by Law 124/2025, fines can reach 10,000,000 euro or 2% of worldwide turnover for essential entities and 7,000,000 euro or 1.4% for important ones. Beyond fines, an untreated security incident can halt the activity, affect customers and damage reputation. Compared with these values, the cost of a correct implementation, with the necessary tools and audit, is an investment in reducing risk.

Common mistakes that inflate the budget

• Confusing the two phases. Paying for implementation consultancy before you have the plan, or believing that the self-assessment package also covers putting the controls into practice, leads to a wrongly estimated budget.
• Wrong classification. An entity that treats itself as essential when it is in fact important implements extra controls and tools for no reason.
• Overestimating your own maturity. When the audit reveals the gaps, last-minute remediation and licences bought in a hurry are much more expensive than implementation planned in good time.
• Collecting evidence only before the audit. Evidence gathered as you work costs little effort; evidence reconstructed a week before the audit generates extra hours and, often, emergency consultancy.

Avoiding these mistakes costs nothing; on the contrary, it saves you money. That is precisely why the free starting steps are also the best budget protection: they give you the correct data before you spend.

How you start with no financial risk

The simplest way to find out how much compliance costs you is to go through the pre-implementation steps for free: classification, risk analysis, self-assessment and plan. Only with the plan in front of you do you know which controls and which tools you are missing, so you can discuss concrete figures for implementation without paying for uncertainty. Start with classification and registration, and you can find the self-assessment consultancy prices anytime on the prices page.

Start the classification for free

Do you have questions about the budget or the next steps? Write to us and we will reply with transparent benchmarks, tailored to your situation.