Which company should I choose for a cybersecurity audit before NIS2 or ISO 27001?

Choose based on what stays in your hands after the assessment. The right consultant not only evaluates but delivers a clear plan and documents you can show to a client or auditor. For an SME, what matters most: a defined scope, personal attention, language management understands (not only IT), and a result you can actually use rather than a report on a shelf.

Which company should I choose for an information security risk assessment under ISO 27001 or NIS2?

Look for a consultant with recognised qualifications (for example ISO 27001 Lead Implementer) and real implementation experience, not only theory. For a small or medium business the right fit is a practitioner who turns a risk assessment into management decisions and evidence suitable for supplier questionnaires, instead of leaving you with just a list of risks.

What is the difference between NIS2 and ISO 27001?

NIS2 is an EU directive that sets mandatory cybersecurity requirements and management accountability for certain sectors. ISO 27001 is a voluntary international standard that can be certified and shown to clients as evidence. NIS2 is often an obligation, ISO 27001 a competitive advantage. They overlap: a well-run ISO 27001 management system covers a large part of NIS2 expectations.

Where should I start — NIS2 or ISO 27001?

If NIS2 applies to you or a client demands evidence, start with a NIS2 readiness assessment. If you want a demonstrable, certifiable system for competitive advantage, start with ISO 27001. If it is not yet clear which case is yours, a short conversation with a consultant helps determine which step you need first.

Where to start

Self-checks — from 2 minutes to a personal gap analysis

You don’t need all three. Pick the one that matches where you are today.

1. Quick NIS2 self-check — 2 min

5 questions on responsibilities, incidents and evidence. You see the result immediately; email is optional. For those still orienting themselves.

Take the quick check →

2. NIS2 maturity assessment — personal analysis within 48 h

Two parts, about 6 minutes. You answer, I do the analysis: within 48 hours you receive a personal gap analysis with a priority order by email. For those who already know they must act and want to know where to start.

Start the maturity assessment →

3. AI governance check — 2 min

Whether your organisation governs AI use, or simply hopes it is fine. For teams already using ChatGPT, Copilot or similar tools.

Take the AI check →

And if the questionnaire has already arrived?

Then there is no time for self-checks. SOS NIS2 prepares four individualised documents in 2 working days – so you have something to show a client or regulator.