What does NIS2 actually cost?

The three costs of NIS2

When people ask “how much does NIS2 cost?” they usually mean one of three different things. It’s worth separating them, because only one is open-ended:

1. 1. The compliance cost. What you spend to meet the Article 21 measures — governance, risk management, MFA and EDR, incident handling, backups, supply-chain diligence. This scales with your size, sector and current maturity; there is no universal figure, and anyone quoting one without seeing your estate is guessing.
2. 2. The fine ceiling. The administrative penalty for non-compliance is the higher of a flat floor or a percentage of global annual turnover — up to €10M or 2% for essential entities, and €7M or 1.4% for important entities (Directive (EU) 2022/2555, Art. 34). That’s what the calculator above estimates. It’s a ceiling, not a prediction.
3. 3. The incident cost. The big, quantifiable one: what a breach actually costs you in downtime, business interruption, forensics, ransom and regulatory liability. This is the number NIS2 exists to reduce — and the number most organisations never put in euros.

Nisura focuses on #3. We map your external attack surface to a projected Expected Annual Loss in euros, then show the NIS2, GDPR and DORA liability that rides on top — so the cost of compliance can be weighed against the cost of doing nothing, in the same currency.

Figures are indicative ceilings for the company under Article 34, not a prediction of an actual penalty, and separate from the personal liability of directors. National implementing law governs. Not legal advice.