— RegulationNIS2 Compliance
The directive expanding cybersecurity to thousands of European organizations — directly engaging the liability of their executives.
Sectors covered
Maximum penalties
Early warning
Of global turnover
Prêt à vous conformer à NIS2 ?
Évaluez votre maturité, scorez vos fournisseurs et documentez votre conformité — depuis une seule plateforme.
- Cyber rating automatisé de votre organisation et de vos fournisseurs
- Questionnaire NIS2 structuré article par article
- Audit probant par nos partenaires qualifiés PASSI
- Tableau de bord de supervision des tiers critiques
Prêt à vous conformer à NIS2 ?
Notre équipe vous recontacte sous 24h.
Who is affected ?
Essential entities
- Energy
- Transport
- Health
- Drinking water
- Wastewater
- Digital infrastructure
- Public administration
- Space
- Banking sector
- Financial markets
Important entities
- Postal services
- Waste management
- Chemical industry
- Food industry
- Medical device manufacturing
- Electronics
- Automotive
- Digital services
In total, NIS2 affects tens of thousands of organizations in France, well beyond the original NIS1 scope.
Are you affected by NIS 2 ?
Determine in 3 minutes whether your organization is subject to the directive and what your status would be: Essential Entity or Important Entity.
Launch the NIS 2 simulatorNIS2 is not a minor update to NIS1. It's a step change. The directive significantly broadens the scope of organizations covered, strengthens risk management obligations, mandates oversight of critical suppliers, and introduces heavy administrative penalties — including personal liability for executives.
In France, national transposition is underway. But the requirements are already known, and organizations waiting until the last moment face a major risk: discovering in a matter of weeks compliance gaps that take months to close.
Conitiv enables you to assess your NIS2 maturity, score your suppliers' cyber risk, and document your compliance with enforceable evidence — all from a single platform.
What NIS2 specifically requires
Governance and executive liability
NIS2 makes cybersecurity a board-level concern. Management bodies must approve risk management measures, monitor their implementation, and can be held personally liable for failures.
Cyber risk management
Formalized risk analysis, documented security policies, proportionate technical and organizational measures. NIS2 requires an 'all-hazards' approach covering network security, access management, encryption, and business continuity.
Critical supplier oversight
NIS2 requires assessing risks related to your IT suppliers and service providers, documenting this assessment, and ensuring regular monitoring. No checkbox exercise — real, traceable, and proportionate oversight.
Incident notification
Early warning within 24 hours, full notification within 72 hours, final report within one month. Procedures must be operational, tested, and documented.
Penalties
Up to €10 million or 2% of global turnover for essential entities. Up to €7 million or 1.4% for important entities. Possibility of temporary suspension of management functions.
The major challenge: overseeing your third parties
Critical supplier oversight is the most demanding aspect of NIS2 for most organizations. Collecting an attestation once a year is not enough. NIS2 requires continuous, documented, and risk-proportionate assessment.
in maximum penalties
Concretely, you need to identify your critical suppliers, assess their cyber posture, formalize contractual security clauses, track changes in their risk level, and be able to demonstrate all of this in case of an inspection.
This is exactly what Conitiv delivers: automated cyber scoring for all your third parties, NIS2 questionnaires for the most critical ones, and evidence-based audits for strategic partners — all centralized in a consolidated portfolio with real-time alerts.
How Conitiv helps you comply with NIS2
Cyber rating for your organization and third parties
Digital perimeter scan: attack surface, vulnerabilities, email configuration. Score out of 1,000, broken down by perimeter. 1 million companies covered. Continuous monitoring with alerts.
NIS2 questionnaire aligned with the directive
Structured article by article to assess your maturity on each requirement: governance, risk management, continuity, incidents, third parties. Usable for self-assessment or sent to your suppliers.
Evidence-based audit by our PASSI-qualified partners
Document-based verification of your policies, procedures, records, and technical evidence. The report is enforceable with regulators.
Third-party management in a consolidated portfolio
Import your suppliers, score them automatically, segment by criticality, send appropriate questionnaires, and track changes in their cyber posture.
You are subject to NIS2 — or you are assessed by a client who is
If you are an entity subject to NIS2
- →Assess your cyber maturity and NIS2 compliance with a structured article-by-article questionnaire.
- →Automatically score your critical suppliers on cyber risk and solvency.
- →Document your third-party oversight with evidence enforceable by regulators.
If you are a supplier to an entity subject to NIS2
- →Anticipate your clients' questionnaires by assessing your own cyber posture.
- →Improve your cyber rating to remain in the supplier panel.
- →Prepare for the evidence-based audits your NIS2 clients will require.
The NIS2 European directive came into force in January 2023. Its transposition into French national law is underway. The requirements are already known, and affected organizations have every reason to act early: compliance gaps take months to close.
NIS2 applies to essential and important entities across 18 sectors. The scope is significantly broader than NIS1. Criteria include organization size, sector of activity, and role in the value chain. Conitiv can help you assess your exposure.
No. Conitiv prepares you for NIS2 compliance by assessing your maturity, scoring your third parties, and documenting your oversight. Conitiv evidence-based audits are conducted by our PASSI-qualified partners and produce enforceable reports, but do not substitute for a certification audit by an accredited body.
Self-assessment on the Conitiv platform takes a few hours. Cyber scoring of your third parties is instant. For a complete program including questionnaires and evidence-based audits, allow 3 to 6 months depending on the size of your ecosystem.
Yes. Many of our clients use Conitiv primarily for critical supplier oversight: automated cyber scoring, targeted NIS2 questionnaires, and continuous monitoring. You can start by scoring your most critical third parties and expand gradually.
Ready to assess your NIS2 maturity?
Demandez une démonstration personnalisée
Découvrez comment Conitiv accompagne votre mise en conformité NIS2, de l'évaluation initiale au suivi continu de vos tiers.
- Démonstration sur vos propres données de sous-traitance
- Analyse de votre niveau de maturité NIS2 actuel
- Plan d'action personnalisé et priorisation des chantiers
Demandez une démonstration personnalisée
Notre équipe vous recontacte sous 24h.
expert Conitiv