NIS2 implementation for Swiss companies
NIS2 applies in the EU, but it also affects many Swiss companies: through subsidiaries, services in the EU or as a supplier to EU customers. We clarify whether you are affected and implement the requirements pragmatically.
What NIS2 requires
The NIS2 Directive (EU 2022/2555) requires medium-sized and large companies in 18 sectors to have appropriate cyber risk management. This includes risk analyses, incident handling, business continuity, supply chain security, cryptography, access control and training.
Significant security incidents must be reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report after one month. Management must approve and oversee the measures and undergo training.
NIS2 does not apply directly to Swiss companies. But if you operate in the EU or supply EU customers in critical sectors, the requirements reach you through contracts and supplier questionnaires. In parallel, since 1 April 2025 Switzerland has had a reporting obligation for cyber attacks on critical infrastructures under the Information Security Act (ISA).
How we implement it with you
Clarify applicability
1–2 daysSector, size, EU links and customer contracts: we clarify whether and how NIS2 applies to you.
Gap analysis
1–3 weeksComparison with the measures under Art. 21 and existing standards such as ISO 27001.
- Maturity level per measure
- Prioritised gaps
Implementation
project-basedPolicies, risk management, incident response, supply chain and technical controls.
- Reporting playbook
- Supplier assessment
Evidence & operation
ongoingEvidence, controls and reports are managed in the GRC platform, with AI agents if you wish.
What you have at the end
Frequently asked questions
Does NIS2 also apply to Swiss companies?
Directly only if you are established in the EU or provide services there. Indirectly, NIS2 affects many Swiss companies through EU customers who pass on security requirements in contracts and questionnaires.
Which deadlines apply after an incident?
An early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that. In Switzerland, critical infrastructures must also file the ISA report to the BACS within 24 hours.
Do we need ISO 27001 certification for NIS2?
No, NIS2 does not require certification. However, ISO 27001 covers most of the requirements and is the simplest way to demonstrate implementation to customers and authorities.
How long does implementation take?
We clarify whether you are affected within a few days. Depending on your maturity level, implementation takes from a few weeks to a few months. With Swiss GRC Hosting and our AI agents, you significantly reduce the ongoing effort.
Where do you stand today?
In a free initial consultation, we clarify your scope and the next three steps.