Are we in scope of NIS2?
Sector and size suggest you are, but there is no documented assessment.
NIS2 compliance with Microsoft 365
Implement NIS2 in Microsoft 365 and evidence every measure.
Whether you are in scope of NIS2 is clarified in the Gap Assessment. We then implement the Section 30 BSIG measures in Entra ID, Defender, Intune, Purview and Sentinel and evidence each one for auditors and management.
- For
- Companies with 50 or more employees on Microsoft 365
- Scope
- Microsoft 365, Entra ID, Intune and Azure against Section 30 BSIG
- Implementation
- Entra ID, Defender, Intune, Purview, Sentinel
- Outcome
- Finding and evidence source per measure, prioritised roadmap
- Price
- €3,500 to €5,000 excl. VAT, fixed price for the Gap Assessment as the first step
Sound familiar?
Who is NIS2 implementation with WCS for?
For companies with 50 or more employees that run on Microsoft 365 and need someone who also implements the measures in the tenant.
Management is accountable
Under Section 38 BSIG, management must implement and oversee the measures, and is liable for culpable breaches.
What does Microsoft 365 already cover?
The licences are there, but nobody can show per measure what is configured and evidenced.
NIS2 checklist for Microsoft 365
Which NIS2 requirements do you already meet?
We check every measure in Section 30 BSIG against your tenant's configuration. Switch the view to see how each one becomes implementation and evidence.
Your tenant Microsoft 365, Entra ID, Intune, Azure
read-only
Checked against Section 30 BSIG Measures under Section 30(2) BSIG
- 1 Access control and MFA (no. 9, 10) Implemented in: Entra ID › Conditional Access, PIM Phishing-resistant MFA and PIM for admin roles Access control and MFA (no. 9, 10)
- 2 Incident handling (no. 2) Implemented in: Defender XDR, Sentinel, unified audit log Enable analytics rules, extend log retention Incident handling (no. 2)
- 3 Business continuity (no. 3) Implemented in: Microsoft 365 Backup Set up backup, test restores Business continuity (no. 3)
- 4 Supply chain security (no. 4) Implemented in: Entra ID › External Identities Set up access reviews for guests Supply chain security (no. 4)
- Acquisition and maintenance (no. 5) Implemented in: Intune › Update rings, Defender Vulnerability Management Acquisition and maintenance (no. 5) In place, evidence is filed
- Training and awareness (no. 7) Implemented in: Defender for Office 365 › Attack simulation training Training and awareness (no. 7) In place, evidence is filed
Example. Every finding names the Section 30 BSIG measure and the place in the tenant where it is implemented. Ordered by risk: identities first, then detection and reporting, then recovery and supply chain.
How does NIS2 implementation work?
Five steps from the first finding to the evidence. After the Gap Assessment, you decide how to proceed.
-
In the Gap Assessment
Clarify scope
Place sector and thresholds against the BSIG criteria, based on your information.
-
Fixed price, read-only
Gap Assessment
Check Microsoft 365, Entra ID, Intune and Azure against Section 30 BSIG, one finding per measure.
-
Following the roadmap
Implementation
Build the measures in Entra ID, Defender, Intune, Purview and Sentinel, ordered by risk.
-
For auditors and Section 38
Evidence
Evidence per measure from the tenant that can be produced again at any time.
-
Your choice
Incidents and reporting
Managed Security operates Defender and Sentinel and supports you with incidents and reporting.
Where does your tenant stand against Section 30 BSIG?
In a 30-minute introductory call we agree the scope, followed by a fixed-price proposal for the Gap Assessment.
Section 38 BSIG
Evidence for auditors and management
Management must implement the measures and oversee their implementation. We implement the technical measures and deliver the evidence, working alongside your ISMS lead or GRC adviser.
Evidence per measure
For example policy exports, incident history with timestamps and logged restore tests.
Overview for management
A management summary and prioritised roadmap that let management oversee the implementation.
Aligned with your ISMS
Findings and evidence are mapped to Section 30 BSIG. Your ISMS lead or GRC adviser carries them into policies and risk management.
What changes?
Today
- Scope not documented
- Unclear what Microsoft 365 already covers
- Auditor questions without evidence
- Management without an overview
Afterwards
- Scope assessed and documented
- Finding per Section 30 BSIG measure
- Evidence per measure from the tenant
- Roadmap and management summary
Further reading: Gap AssessmentMicrosoft 365 hardeningManaged SecurityBlog: NIS2 in GermanyBlog: Incident response in the tenant
Frequently asked questions
Is our company in scope of NIS2?
What counts is the sector, as listed in Annexes 1 and 2 of the BSIG, and size: as an important entity from 50 employees, or with annual turnover and balance sheet total each above €10 million. We assess this in the Gap Assessment based on your information and the criteria in the act. This is not legal advice.
Is Microsoft 365 enough to comply with NIS2?
No. The tools cover many measures, but only take effect once they are configured, operated and evidenced. Risk analysis, the reporting process, contingency planning and management training are organisational tasks.
Which reporting deadlines apply to a security incident?
Under Section 32 BSIG, for significant incidents: initial report no later than 24 hours and incident notification no later than 72 hours after becoming aware, final report no later than one month after the notification. Defender XDR and Sentinel record incidents with timestamps, the basis for reporting on time.
What does NIS2 implementation with WCS cost?
The first step is the fixed-price Gap Assessment, €3,500 to €5,000 excl. VAT depending on the size of your environment. We then quote the implementation based on the findings.
How much of NIS2 does your tenant meet today?
The Gap Assessment gives you a finding and evidence source per measure, at a fixed price.