Direct answer: the first question to ask a NIS2 consultant is "am I actually a regulated entity under NIS2?" NIS2 (Directive (EU) 2022/2555) regulates organisations that provide services or carry out activities in the EU, belong to a sector in Annex I or Annex II and, as a rule, are at least medium-sized (some types, such as telecoms providers, trust service providers, DNS providers and top-level domain name registries, are covered regardless of size); they are classified as essential or important entities. A supplier with no establishment in the EU that merely supplies regulated EU customers is usually not a regulated entity; the requirements reach it through contract terms that the customer writes in under the supply chain security requirement of Article 21. But if you provide one of the digital services listed in Article 26 (for example cloud computing, data centres, or managed services that install, manage or operate customers' ICT systems on site or remotely), you may be directly regulated even without an EU establishment. The situations call for completely different work. Next, check whether the consultant can build the ten risk-management measures of Article 21 and the reporting of Article 23 (an early warning within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident, and a final report within one month of the notification) on the ISO 27001 system you already have.
Three common situations for Taiwanese companies
| Situation | Basis | What to do |
|---|---|---|
| Essential or important entity with an EU establishment, above the threshold | Sector in Annex I or Annex II, as a rule medium-sized or larger; some types such as telecoms, trust services, DNS and top-level domain name registries regardless of size (Articles 2 and 3) | Register under the national transposition law, implement the Article 21 measures, report under Article 23 |
| No EU establishment, offering certain digital services in the EU | A digital service listed in Article 26 that is within the scope of Article 2, for example cloud computing, data centres, content delivery networks, managed services (MSP, including installing or operating customers' ICT systems on site or remotely), managed security services (MSSP) | Designate a representative in the EU and meet the obligations above |
| Supplier to regulated EU customers | None of the above | Respond to the contract terms and audits that customers raise under the Article 21 supply chain security requirement |
Eight criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Determining applicability | Which situation am I in? On what sector, size threshold and jurisdiction rule is that based? |
| National transposition laws | In which Member States are my establishments or customers? What extra requirements and registration procedures do the local transposition laws add? |
| The ten Article 21 measures | Which part of my current system does each of the ten risk-management measures map to? Where are the gaps? |
| Reporting process | For the early warning within 24 hours and notification within 72 hours of becoming aware, and the final report within one month of the notification, who decides whether an incident is significant, and who submits? |
| Management accountability | How are records kept of management approving and overseeing the cybersecurity measures (Article 20)? |
| Supply chain security | How do I respond to the security clauses customers ask me to sign? What must I do about my own suppliers? |
| Integration with ISO 27001 | Can the NIS2 gaps be added on top of my existing ISO 27001 system, rather than building a second one? |
| Who leads, and is it outsourced | Who actually runs the engagement? What are their qualifications? Will it be subcontracted? |
When you may not need a consultant
If you are certain you are not a regulated entity and your customers only ask you to fill in a security questionnaire, answering with your existing ISO 27001 system and records is usually enough. If you need a legal opinion on jurisdiction or applicability, consult a lawyer who knows the local transposition law.
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Determining applicability: from sector, size and the transposition law of the Member State concerned, we determine whether you are an essential or important entity, or only need to respond to customers' supply chain requirements
- The ten Article 21 measures: each measure is checked against your current information security management system, incident reporting, supplier management and technical measures, producing a prioritised list of fixes
- Reporting process: a three-stage 24-hour, 72-hour and one-month reporting procedure, confirmed by tabletop exercises to be repeatable
- Management accountability: a cybersecurity responsibility matrix and approval records for senior management
- Supply chain security: a supplier risk assessment procedure and contractual security clauses
- Integration with ISO 27001: NIS2 gaps are added on top of your existing ISO 27001 system, so one set of evidence answers NIS2 and customer requirements
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced
Related questions
- How is NIS2 different from the CRA? The CRA regulates products with digital elements; NIS2 regulates organisations' cybersecurity risk management and incident reporting. A company that exports products to the EU and also provides services there may be subject to both. How to choose a CRA consultant in Taiwan
- Is ISO 27001 enough? ISO 27001 greatly shortens preparation, but NIS2 adds reporting deadlines, registration with the authorities, supply chain security and management accountability, which must be added on top of ISO 27001. NIS2 EU cybersecurity directive consulting
- How long does NIS2 consulting take? From gap analysis to a working system usually takes four to six months; with an existing ISO 27001 system it can be shortened to two to three months. NIS2 EU cybersecurity directive consulting
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.