Essential entities
Generally large organisations (250+ employees, or more than €50M turnover and €43M balance sheet) in high-criticality sectors.
Proactive supervision
Fines up to €10M or 2% of global turnover
WebSafety Ninja · GRC & compliance
Audit-ready.
For real.
We help you close the gaps for NIS2, DORA, ISO/IEC 27001 and ISO/IEC 42001, and build the evidence your auditor, regulator and customers will ask for.
- Auditors and pentesters in one team
- Gap analysis to audit readiness
- Evidence, not template policies
Four frameworks, one team
Which rules apply to you?
Two are EU law, two are voluntary standards. Many organisations face more than one, and they overlap. We map them together so you do the work once.
EU directive · mandatory
NIS2
- Who
- Medium and large organisations in 18 critical sectors, and some regardless of size.
- Status
- In force in the Netherlands since 15 August 2026 (Cyberbeveiligingswet).
- Why it matters
- Fines up to €10M or 2% of global turnover. Management is accountable.
EU regulation · mandatory
DORA
- Who
- Banks, insurers, investment, payment and crypto firms, and their ICT suppliers.
- Status
- Applies across the EU since 17 January 2025.
- Why it matters
- Supervisory measures and penalties from your financial regulator.
International standard · voluntary
ISO/IEC 27001
- Who
- Any organisation that needs to prove information security to customers.
- Status
- Certified by an accredited certification body, then audited every year.
- Why it matters
- Often required in tenders, enterprise deals and supplier questionnaires.
International standard · voluntary
ISO/IEC 42001
- Who
- Organisations that build, provide or use AI systems.
- Status
- Published December 2023, the first certifiable AI management system standard.
- Why it matters
- A way to show responsible AI governance as the EU AI Act phases in.
NIS2 · Cyberbeveiligingswet
NIS2 is live. Is your evidence?
The NIS2 Directive raises the cybersecurity bar for thousands of organisations across the EU. In the Netherlands it took effect through the Cyberbeveiligingswet on 15 August 2026, with no general transition period. Registration, duty of care and incident reporting apply now.
Important entities
Generally medium-sized organisations (50+ employees, or more than €10M turnover and balance sheet) in any covered sector.
Supervision after a signal or incident
Fines up to €7M or 1.4% of global turnover
Some providers, such as DNS and trust service providers, are in scope regardless of size. Not in scope? If your customers are, their NIS2 supply chain requirements will likely reach you.
Sectors covered
High criticality
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management (B2B)
- Public administration
- Space
Other critical
- Postal and courier services
- Waste management
- Chemicals
- Food
- Manufacturing
- Digital providers
- Research
What NIS2 asks of you:
01Duty of careRisk-based security measures: risk analysis, incident handling, business continuity, supply chain security, access control, encryption and MFA.
02Incident reportingEarly warning within 24 hours, notification within 72 hours, final report within one month.
03RegistrationIn-scope organisations must register with the national authority (in the Netherlands: the NCSC register).
04Board accountabilityManagement must approve and oversee the measures, follow cybersecurity training, and can be held liable.
There is no NIS2 certificate. Anyone selling one is selling something else. What counts is a working set of measures and the evidence to show your supervisor. We help you build both, often on an ISO/IEC 27001 backbone so the work also supports certification.
DORA · Digital Operational Resilience Act
Resilience you can demonstrate.
DORA has applied to EU financial entities since 17 January 2025: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and more. It also reaches their ICT suppliers through mandatory contract terms and third-party risk management.
Supervisors (in the Netherlands, DNB and AFM) now expect more than policies. They want to see that your ICT risk framework works, that incidents are classified and reported on time, and that your resilience is tested.
The five pillars
- 01ICT risk management
- 02ICT incident management & reporting
- 03Digital operational resilience testing
- 04ICT third-party risk management
- 05Information sharing
Our team covers the two pillars most firms struggle with: ICT third-party risk management, and resilience testing with hands-on penetration testing.
ISO/IEC 27001 · Information security management
The backbone for everything else.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Customers ask for it in tenders and supplier questionnaires, and it gives you a structure that also covers much of NIS2 and DORA. Our team includes ISO/IEC 27001 Lead Implementers and Lead Auditors, so we know what the auditor will look for before you meet them.
- 01
Implementation of your ISMS
You + WebSafety Ninja
- 02
Internal / readiness audit
WebSafety Ninja
- 03
Certification audit
Accredited certification body
We prepare you for certification. We don't issue it: certificates come from an independent certification body, in the Netherlands accredited by the Raad voor Accreditatie (RvA). That separation is what makes the certificate worth having.
ISO/IEC 42001 · AI management system
Governance for the AI you ship.
ISO/IEC 42001 is the first certifiable management system standard for artificial intelligence. It sets out how you govern, assess and control the AI systems you build, provide or use: roles and policy, AI risk and impact assessment, data and lifecycle controls, and continual improvement.
It shares its structure with ISO/IEC 27001, so an existing ISMS is a strong starting point. It also helps you organise the governance and documentation work the EU AI Act asks for, though on its own it does not make you AI Act compliant.
Talk about AI governanceYou should look at ISO/IEC 42001 if
- You ship AI features in your product or platform.
- Customers send you questionnaires about how you govern AI.
- You use AI on personal or sensitive data.
- You fall under the EU AI Act and want a structured way to organise the work.
- You already run an ISO/IEC 27001 ISMS and want to extend it to AI.
From first call to audit day
How we work.
The process:
01Scope & applicabilityWe confirm which frameworks apply to you, at what level, and what is in scope.
02Gap analysisWe assess your current controls, documents and practice against every requirement.
03RoadmapA prioritised plan: what to fix first, who owns it, and what evidence it needs.
04ImplementationWe help build the policies, processes, risk register and controls, fitted to how you work.
05Readiness auditAn internal audit tests your evidence the way an external auditor or regulator would.
06Audit supportWe support you through the certification audit, carried out by an accredited certification body.
Certifications held by our team
NIS 2 Directive
Lead Implementer
ISO/IEC 27001
Lead Implementer
ISO/IEC 27001
Lead Auditor
DORA
Lead Manager
ISO/IEC 42001
Lead Implementer
CGRC
Certified in Governance, Risk and Compliance, ISC2
Pricing.
€155/hour
Compliance work is billed by the hour, so the cost follows your actual scope. Tell us where you stand and what you're working towards, and we'll estimate the hours together.
Let's discuss the scopeQuestions, answered
Compliance FAQ.
Does NIS2 apply to my organisation?
It depends on your sector, size and services. Most medium and large organisations in the sectors listed in the directive are in scope, and some, such as DNS and trust service providers, are in scope regardless of size. Suppliers of in-scope organisations are often affected indirectly through contract requirements. We check applicability as the first step of every engagement.
Can we get NIS2 certified?
No. NIS2 is a law, not a certification scheme, so there is no official NIS2 certificate. What you need is a working set of measures and the evidence to show your supervisor. Many organisations use ISO/IEC 27001 as the backbone for that.
Will WebSafety Ninja certify us for ISO/IEC 27001 or ISO/IEC 42001?
No, and no consultant should. Certification is issued by an independent, accredited certification body (in the Netherlands, accredited by the RvA). We prepare you for it: implementation, internal and readiness audits, and support during the certification audit.
We are ISO/IEC 27001 certified. Are we NIS2 compliant?
Not automatically. ISO/IEC 27001 covers much of the groundwork, but NIS2 adds its own requirements, such as fixed incident reporting deadlines, registration, management accountability and supply chain measures. A targeted gap analysis shows what is missing without redoing what already works.
We fall under DORA. Do we also need to comply with NIS2?
For financial entities, DORA takes precedence over NIS2 on ICT risk management and incident reporting. Other obligations can still apply, so it is worth mapping both. We look at your full picture during scoping.
We are an ICT supplier to banks or insurers. Does DORA affect us?
Usually, yes. DORA requires financial entities to put specific terms in their ICT contracts and to manage supplier risk, so those requirements flow down to you. Providers designated as critical are also overseen directly by the European supervisory authorities.
What is ISO/IEC 42001 and do we need it?
It is the international standard for an AI management system: how you govern, assess and control the AI you build or use. It is voluntary, but it is becoming a way to answer customer and tender questions about AI and to organise work for the EU AI Act. It uses the same structure as ISO/IEC 27001, so an existing ISMS is a good starting point.
Do you also test whether our controls work?
Yes. Our team includes certified penetration testers, so we can test technical controls, not just review documents. NIS2 expects you to assess how effective your measures are, and DORA requires resilience testing.
How long does it take and what does it cost?
It depends on your scope, your starting point and how much you want to do in-house. After a free consultation we give you a clear plan and quote, before any work starts.
Book a call
Let's map your
requirements.
20-minute call. No sales pitch.
You'll leave with a scope and a price range.
Tell us your sector, size and what's driving the question: a regulator, an auditor or a customer. We'll tell you honestly which frameworks apply and where to start.
Prefer email? hello@websafetyninja.com