NIS2 Consulting & IT Compliance
NIS2 consulting & IT compliance for DACH and KSA
Evolvice builds and operates the controls behind GDPR, BSI IT-Grundschutz, NIS2 and ISO 27001 in Europe, and NCA ECC, SAMA CSF and PDPL in Saudi Arabia — inside one delivery model, one audit trail and one incident framework.
Which requirements apply in Europe and Saudi Arabia?
Access management, logging and incident handling can support more than one framework. Applicability, evidence requirements and reporting duties still need to be assessed separately for each jurisdiction and sector; a shared control set is not proof of compliance.
Europe / DACH
- GDPR (EU 2016/679)
- BSI IT-Grundschutz & BSI C5
- NIS2 Directive
- ISO/IEC 27001:2022
- BaFin & KRITIS sector rules
Saudi Arabia / KSA
- PDPL (2023) & SDAIA guidance
- NCA Essential Cybersecurity Controls
- SAMA Cybersecurity Framework
- CCC cloud classification
- Vision 2030 digital mandates
For organisations that want to use AI with confidential data under GDPR and trade-secret constraints, our enterprise Private AI Workspace provides a controlled technical environment, separate from public AI services. It does not replace AI governance — policies and controls remain part of the compliance programme.
The services that carry the compliance workload
A compliance programme only holds if someone operates the controls. These five services produce the evidence auditors and regulators ask for.
Compliance questions we are asked first
What is NIS2?
NIS2 is EU Directive (EU) 2022/2555 on the cybersecurity of network and information systems. It requires in-scope organisations to implement risk-management measures, report significant incidents and hold management accountable. Germany transposes it through the NIS2 Implementation Act, supervised by the BSI.
Who is affected by NIS2?
In principle, medium-sized and large organisations in the sectors listed in Annexes I and II of the directive — such as energy, transport, health, digital infrastructure, manufacturing and digital services. Some entities are in scope regardless of size. A scoping check based on sector, size and activity confirms whether your organisation is affected.
What does NIS2 consulting at Evolvice cover?
A scoping check, a gap assessment against NIS2 requirements, a prioritised remediation plan and implementation of the technical controls — access management, logging, incident response and supplier governance — with audit-ready evidence. It connects with our security consulting and managed security services.
How does NIS2 relate to detection and response?
NIS2 requires essential and important entities to handle security incidents and report significant ones — an early warning within 24 hours and a notification within 72 hours. That depends on continuous monitoring, detection and a practised response process. We design these controls in the compliance programme; ongoing detection and response is operated through our Managed Security Services.
What are IT compliance services?
IT compliance services translate regulatory requirements into implemented technical controls, monitoring, and audit evidence. At Evolvice this covers gap assessment, control design, implementation, continuous monitoring and audit-ready reporting against GDPR, NIS2, ISO 27001, NCA ECC, SAMA CSF and PDPL.
Can one control set satisfy both EU and Saudi regulators?
Some controls can support both programmes, including access management, logging, encryption and incident handling. There is no verified universal overlap percentage. Map each applicable requirement to an owner and evidence, then check residency, reporting and sector-specific differences separately.
Does compliance work sit inside Managed Services or Cybersecurity?
Both. Cybersecurity delivers the assessments, testing and security operations; Managed Services operates the platforms and produces the evidence. The compliance hub is the shared governance layer between the two pillars.
How long does a first compliance gap assessment take?
The timeline depends on the framework, number of entities and systems, available evidence and stakeholder access. Agree the scope, evidence request and review dates before committing to a schedule; the assessment should identify gaps, priorities and responsible owners.