One directive, eight different obligations
NIS2 is a directive, and a directive is an instruction to twenty-seven legislatures. Whether an audit is required at all, who may perform it and how often differs by country.
If your group operates in several EU countries, you have probably been told that NIS2 is one rule. It is not. NIS2 is a directive, and a directive is an instruction to twenty-seven legislatures. What arrived at the other end differs — not in spirit, but in the things your programme actually depends on: whether an audit is required at all, who is allowed to perform it, how often, and whether a foreign firm can do it.
What is genuinely the same everywhere
Four instruments apply directly and their text is identical in every member state:
- GDPR — Regulation (EU) 2016/679
- DORA — Regulation (EU) 2022/2554
- AI Act — Regulation (EU) 2024/1689
- Cyber Resilience Act — Regulation (EU) 2024/2847
For these you can write one policy, run one assessment and keep one set of evidence.
With one caveat that catches groups out. Even GDPR leaves room for national rules — processing in the employment context under Article 88, the age of consent for information society services, and national conditions for special categories of data. A single group-wide privacy framework is correct; a single group-wide employment privacy notice usually is not.
What is not the same
Under NIS2, the audit obligation itself differs by country. This is what we have verified from primary sources:
| Country | Who may perform the audit | What we do there |
|---|---|---|
| Slovakia | certified cybersecurity auditor | preparation, documentation, acting as cybersecurity manager including self-assessment; audit with cooperating certified auditors |
| Czechia | a person trained in auditing, with at least three years' experience in performing cybersecurity or ISMS audits, who assesses independently and holds no other security role | services are delivered and the contract concluded by a member of the IOSEC group established in Czechia; IOSEC Slovakia handles the enquiry and is the counterparty for group-wide engagements |
| Poland | an accredited conformity assessment body, or at least two auditors holding a recognised certificate; no Polish establishment required | we deliver, including the audit |
| Hungary | only a legal entity listed in the SZTFH register | services are delivered and the contract concluded by a partner of the IOSEC group; IOSEC Slovakia handles the enquiry and is the counterparty for group-wide engagements |
| Austria | an independent body (unabhängige Stelle) with an auditor admitted by the Austrian authority | preparation and accompaniment |
| Germany | accredited assessor for critical installations; most entities have no periodic audit at all | preparation, documentation, self-assessment |
| Romania | auditor holding a valid DNSC attestation | preparation and accompaniment |
| Greece | an internal or external auditor; no accreditation, no register | we deliver, including the audit |
Two things in that table usually surprise people.
In Germany, most entities have no recurring audit obligation. Only operators of critical installations must produce evidence of conformity every three years. For everyone else the supervisory authority may order an audit, but there is no periodic duty and no "NIS2 certificate".
In Hungary the door is effectively closed to foreign auditors. Registration requires a domestic company registration number and filing through a domestic portal; every registered auditor is established in Hungary.
And a duty that several countries share
Where the audit obligation is light, something else is heavy: self-assessment. Romania requires an annual maturity self-assessment alongside the audit. Greece requires an annual self-assessment submitted to the national authority, plus an annual external penetration test. Germany and Czechia expect continuous evaluation.
This is the part a group can run centrally — one method, one evidence format, one calendar — and it is the part that most often gets neglected because no certificate comes out of it.
What this means for a group programme
You cannot run one audit programme across the EU. You can run one method. Scope definition, risk methodology, evidence structure, self-assessment and management review can be identical everywhere; the audit is then a local act performed by whoever the local law allows.
That is how we work: one counterpart on your side and unified templates. Who delivers in each country is in the table above — and we never claim we will perform an audit where we are not allowed to.
One set of templates, eight countries
The IOSEC group operates in Slovakia, Czechia, Poland, Hungary, Austria, Germany, Romania and Greece — and works with unified templates.
That is the whole difference, and it is worth stating precisely. It is not that we are present in several countries; several consultants are. It is that a subsidiary in Bratislava, Bucharest and Athens receives a document built the same way — the same names, the same order, the same logic. Differences between countries are in the content where local law requires them, not in how the document is organised.
For the head office this means three things at once. Subsidiaries can be compared. A measure introduced once can be transferred instead of being reinvented in the next country. And one contract and one phone number instead of five coordinations.
more than 17,000 clients of the IOSEC group in eight European countries
Organisations, not individuals. As of January 2026.
“Isn’t it a risk to give the whole group to one supplier?”
It is the right question, and the answer is not that we are big.
The risk you have today is divided, and that is why you do not see it. Five consultants mean five levels of quality, five readings of the same directive and nobody responsible for the whole. When something does not fit, each of them points to local specifics.
One supplier does not increase the risk, it makes it visible. Responsibility sits in one place, quality is one, and the differences between countries are explained, not hidden.
And where we have no capacity of our own, we say so in advance — and in the table above.
Who it makes sense for
For groups with subsidiaries in more than one of those eight countries, at least one of which falls under one of the NIS2 transpositions or under DORA.
Most of all where the head office is responsible for the security of the whole group but has no way of checking what is really happening in the individual countries.
It makes no sense if you operate in a single country. Then a local consultant is cheaper and just as good — and we will tell you so.
How it starts
It does not start with an offer, but with an overview: which of your companies fall under what.
We go through your entities, their size and sectors, and tell you which one is an entity in scope in which country, which category it belongs to and which deadlines apply to it. The overview has value even if we do not continue together — and it is usually the first document that says anything about the group as a whole.
Audits that do not need a national authorisation
An internal audit or a supplier audit under the GDPR or ISO/IEC 27001 is not tied to an authorisation in a particular country, so a network of subsidiaries, dealers or branches across several countries can be covered by a single programme — how such a programme runs is on Automotive network audits.
Where our work ends
- We do not perform penetration tests or threat-led penetration testing.
- Nobody audits their own work. Where we hold the security manager role at a client, we do not audit that client.
- Certificates against ISO/IEC 27001 and ISO 22301 are issued by an accredited certification body, not by an advisor. TISAX assessments may only be performed by an ENX-accredited provider.
Verified against national regulations as of 10 September 2026.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.