NIS2, ENS and ISO 27001 Assessment
Three frameworks, one single assessment.
Applicability and gap analysis against NIS2, ENS and ISO 27001, a review of Microsoft 365 security posture and a prioritized action plan for management, in about 10 days.
- Over 15 years of experience
- Microsoft Partner since 2010
- Over 200 large organizations as clients
- ISO 27001 certified
- In-house team in Barcelona and Madrid
THE STARTING POINT
Having security is no longer enough
Customers, management and auditors no longer ask whether controls exist: they ask for evidence that they work.
REGULATION
NIS2 is now enforceable in Europe
EU Directive 2022/2555: demonstrable security across 18 sectors. The transposition deadline expired in October 2024.
SPAIN
The Spanish law, still without a date
Draft bill approved in January 2025 and still unpublished. In July 2026, Brussels took Spain to the CJEU.
CUSTOMERS
The requirement arrives through contracts
Obligated entities pass NIS2 on to their suppliers: questionnaires, clauses and security audits.
MANAGEMENT
Management is personally accountable
The draft bill provides for penalizing and even temporarily disqualifying executives for non-compliance.
Setting up a security program takes months: anyone who waits for the law to start will be late.
Does it affect you, directly or indirectly?
If you identify with any of these scenarios, the assessment determines your real exposure.
SIZE AND SECTOR
Within the scope of NIS2
50 employees or more, or over €10M, in sectors such as energy, transport, healthcare, ICT, food or manufacturing.
SUPPLY CHAIN
Supplier of an obligated entity
Your customers must assess their suppliers and ask you for evidence, even if the law does not directly bind you.
PUBLIC SECTOR
Customer or supplier of the Administration
The ENS (RD 311/2022) is mandatory for the public sector and for those who provide services to it.
CERTIFICATION
You are asked for accredited guarantees
Approvals, tenders or customers that require ISO 27001 as a security guarantee.
Progress in one of the three frameworks covers a good part of the other two: the assessment takes advantage of this.
First assessment, then investment
Before implementing controls: know what you have, what you are missing and which actions have the most impact.
WITHOUT AN ASSESSMENT
Investing blindly
- Tools bought before knowing the gap
- NIS2, ENS and ISO 27001 handled separately
- What Microsoft 365 already covers, left unused
- Technical reports that management cannot use
- Not knowing whether the company falls under NIS2
Result: more spending and the same risk, unmeasured
WITH ITEQUIA
A single map of priorities
- NIS2 applicability and ENS category determined
- Controls common to all three frameworks, unified
- Configuration separated from new investment
- Executive traffic light designed for management
- Prioritized plan: quick wins and long-term investments
Result: data-driven decisions, in about 10 days
Three frameworks, one single assessment
They are not the same type of requirement, but they share a good part of their controls.
EUROPEAN LEGAL OBLIGATION
NIS2
Critical sectors with 50 employees or more, or over €10M, and their suppliers by contract. Demonstrated with evidence.
MANDATORY SCHEME
ENS
Public sector and its suppliers. Audit according to the system category: basic, medium or high.
VOLUNTARY CERTIFICATION
ISO 27001
Any organization. Audit by an accredited third party of the ISMS and its controls.
Controls common to all three frameworks
Risk management
Risk analysis and treatment: required by all three frameworks.
Access and identity
Access control and MFA, present in all three.
Incidents
Detection, response and notification.
Continuity
Backups, recovery and service continuity.
What we analyze
A single fieldwork covers the three frameworks, the technology platform and third parties.
NIS2
- Applicability and entity type
- Governance and management
- Risk management measures
- Incident notification
ENS
- System categorization
- Organizational framework
- Operational framework
- Protection measures
ISO 27001
- ISMS (clauses 4 to 10)
- Annex A controls
- Certification readiness
Microsoft 365
- Identity, MFA and conditional access
- Devices and data protection
- Activity logs and auditing
Third parties
Critical suppliers
Security clauses
Supplier assessment
Evidence for customers
Already have ENS or ISO 27001? We start from what is already certified and analyze only the remaining gap.
OUR DIFFERENCE
What you already have in Microsoft 365 counts
A good part of the gap does not require buying: it requires properly configuring what is already licensed.
01
Configure before buying
MFA, conditional access, encryption and activity auditing: requirements that a well-configured Microsoft 365 already covers.
02
Configuration or investment
The plan separates adjustments to what exists from new capabilities, with their impact and cost.
03
Licenses with judgment
Defender, Intune, Purview or Sentinel, only where the gap justifies it, and with the partner that implements them.
Ten days, four steps
Indicative duration of 10 working days, depending on the size and complexity of the organization.
01
DAY 1
Kick-off
Initial meeting, systems and processes in scope, and applicable frameworks to review.
02
DAYS 2 TO 5
Evidence
Documentation, interviews with those responsible and review of the technical configuration.
03
DAYS 6 TO 8
Gap analysis
Comparison with each framework and prioritization of shortfalls by risk, impact and cost.
04
DAYS 9 AND 10
Report and close
Delivery of the report and closing session with the technical team and with management.
What you receive: a report to decide
Executive report
Risk traffic light that management understands without technical jargon.
Applicability
In or out of NIS2, essential or important entity, and ENS category.
Gap by framework
Current level of compliance against NIS2, ENS and ISO 27001.
Map of common controls
What covers all three frameworks at once, so you don't do the same work three times.
Prioritized action plan
By risk, impact and cost, with quick wins separated from long-term investments.
Recommended path
Implementation, certification or compliance, with the order and estimated effort.
Certification is granted by an accredited third party: the assessment tells you what you are missing to get there. Implementing measures, certification readiness and ongoing operation are separate services.
HOW IT IS CONTRACTED
Fixed price, no further commitments
Each step is decided with the information from the previous one: the assessment does not oblige you to contract anything else.
01
Initial assessment
A session to confirm the applicable frameworks, the size and the systems in scope.
02
Diagnosis
At a fixed price, depending on size and frameworks. Estimated duration of 10 working days.
03
Implementation
As a project, with the scope and priorities set by the action plan.
04
Operation
Monthly fee with Itequia Cloud Operations: identity, security and Microsoft 365.
The report and the action plan are yours, to carry out with whoever you choose. Microsoft 365 and security licenses, supplied by Itequia, if desired.
The difference from a compliance consultancy
A partner that also knows and operates the technology.
01
Three frameworks, a single map
NIS2, ENS and ISO 27001 share controls: we unify them into a single plan, without paying for three separate jobs.
02
Security we practice
Itequia is ISO 27001 certified and works in regulated environments: banking, pharma, industry and the public sector.
03
Microsoft specialists
We review which part of the gap can be closed by configuring the Microsoft 365 you already have, and we implement it.
What you get
Know whether it affects you
NIS2 applicability and ENS category, without ambiguity.
A gap map
Where you stand against each framework, in a single document.
Clear priorities
Quick wins separated from long-term investments.
A message for management
An executive traffic-light summary to decide and respond.
Less duplicated spending
Common controls and what Microsoft 365 already covers.
Limited cost and timeline
Fixed price and an estimated 10 working days.
Where the diagnosis fits
The diagnosis is the starting point: it works on its own or as an entry to the rest of Itequia's services.
VALIDATE THE DEFENSES
Cybersecurity audit
Technical audit and pentesting of systems and applications.
DIAGNOSE
NIS2, ENS and ISO 27001 Diagnosis
Applicability, gap per framework and prioritized action plan.
IMPLEMENT AND OPERATE
Itequia Cloud Operations
Microsoft 365, identity, security, Azure and licenses.
GOVERN AI
AI Governance
Visible, controlled use of AI: shadow AI and action plan.
Each service is contracted separately. Compliance, security and Microsoft platform with the same partner.
Why Itequia is the best choice for your software development needs?
With over 15 years of experience in the digital sector, we offer efficient and personalized software development services. Our agile methodology and management tools guarantee deliveries that adapt to your needs.
As a Microsoft Solutions Partner, we have the competence and experience to use the most advanced technologies.
We have a team of more than 50 highly qualified human professionals consisting of analysts, designers, developers, testers, consultants, and project managers.
Over 15 years of experience
Frequently asked questions
Are you being asked for security evidence?
Tell us what customers, management or auditors are asking you for, and which frameworks concern you.