Who it’s for
You operate production plants, networks, data centres or digital services and fall under NIS2, or your customers ask for evidence of your information security. Complass guides you from the first overview to audit-ready evidence, even without experts in-house.
With the German NIS2 Implementation Act, obligations under the BSI Act apply to far more companies. Sector and company size are decisive. The main obligations at a glance:
Frameworks: NIS2 · ISO 27001 · IEC 62443 · GDPR · In preparation: ISO 9001 – quality management, Energy Industry Act (EnWG) and IT security catalogue, EU GMP Annex 11 – Computerised systems, 21 CFR Part 11 – Electronic records and electronic signatures
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
You structure production networks, control systems and remote maintenance access with zones and conduits per IEC 62443, linked to your ISMS.
Managed services and data centres are NIS2 sectors of their own. Complass covers your own operation. If you look after customers, also read the page for consultants and IT service providers.
Hospitals and other healthcare entities clarify whether they are covered, implement the minimum measures and report incidents on time. Large hospitals are often critical infrastructure operators.
You build an ISMS per ISO 27001 and answer your customers’ requirements. You prepare for the TISAX assessment with the TISAX framework.
NIS2, ISO 27001 and IEC 62443 in one programme: gap analysis, action plan, Statement of Applicability and evidence up to the audit package.
More about this featureIT and OT assets in one place, captured agentless, with zones and conduits per IEC 62443-3-2. Prioritise known vulnerabilities in context and work through them with deadlines.
More about this featureRecord incidents, check the reporting obligation under NIS2 and track the reporting deadlines with a countdown.
More about this featureStatus, deadlines and open tasks at a glance. Resolutions, oversight and training of the management are documented.
available
from €526 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
What matters is your sector, your company size and in some cases the type of service you provide. The Complass applicability check asks about these points and shows whether you count as an important or essential entity. The result does not replace legal advice, but gives you a reliable first assessment.
No. NIS2 does not require certification. ISO 27001 is, however, a proven framework for implementing and evidencing the measures under Section 30 BSIG in a structured way. In Complass you build both in one programme.
For production plants and control systems, IEC 62443 adds OT-specific requirements to the ISMS: system under consideration, zones and conduits, and security levels. Complass connects both, so your OT assets appear in the same risk register as your IT.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
