Set up to hold
We find the gaps in what you run today, close them one by one and automate the checks, until every measure holds every day of the year. Better protected and compliant at the same time.
← H2 Labs
Systems that hold.
NIS2 · for organisations across the EU
Systems that hold.
The audit follows.
NIS2 is right about what matters, and in places it asks for less than a well-run system already does. In practice it often turns into documents written to pass an audit. Our own systems check every measure automatically and raise the alarm the moment one breaks, so a report on their state is ready any day. We bring yours there step by step, starting from your last audit.
An audit sees two days a year
A check every six months sees what people say on a call and the screenshots they send: what someone remembers, believes or chose to capture, on the day it looks. Attackers keep their own schedule, every day of the year, and companies that passed their audit are breached all the time.
Before
Never set up
Most measures fail most weeks, and nobody knows, because nothing checks.
17%of weeks in order, across the eight measures
For the audit
Set up for the audit
For the audit week most measures are put in order. Some are only reported as fixed, on a call or in a screenshot. A month later, most of them have slipped back.
33%of weeks in order, across the eight measures; in the audit week all eight reported in order, five in fact
With us
Gap by gap
We close one gap after another, each with a way back. From each fix on, a check watches it.
61%of weeks in order, across the eight measures
From then on
Kept, every day
Things still break: a backup fails, an update misses a server. Each break is caught and fixed the same day, before it does harm.
100%of weeks in order, across the eight measures; 12 failures caught and fixed
Told the moment it breaks
Every measure is checked automatically, all the time. When something breaks one (an account without a second factor, a backup that failed, a server that missed its update), you hear about it straight away, and so do we.
A report at any moment
The state of every measure on request, any day, drawn from the systems themselves with nobody’s word or screenshot in between. Behind it, the whole history from the day we start, the bad days included.
Kept systems also simply work better. Left alone, they fail in small ways every day: a disk fills up, a certificate expires, a sync stops, a scheduled job quietly stops running. The updates that close security holes also fix known bugs, and the checks that watch for attacks catch these small failures before people trip over them.
(i) Our own systems already run this way. Yours will not on day one: we get there with you, gap by gap, and from then on it holds every day of the year.
How it works
Free
What applies to you
Tell us your sector and size. Within two working days we reply with what NIS2 asks of you, and how much of it is technical.
Fixed price
Your last audit, checked
We start from your last audit and check each answer against your systems: what is actually true, what is missing, what has changed since. No audit yet? We start from the measures that apply to you.
Then monthly
Gap by gap, then kept
We close the gaps one by one, with a way back at every step, until your systems run the way ours do. Then we keep them there, with the record running.
Prices, before you ask
The check has a fixed price, set by what NIS2 asks of you. So do the fixes that follow it. Prices exclude VAT.
Essential entity
€7,900
The full check, in 15 working days.
Important entity
€4,900
The full check, in 10 working days.
Supplier
€2,900
To a regulated company: the measures your customers ask about, in 5 working days.
After the check, each fix has its own price (listed below), and a monthly plan keeps it all in order. Start the fixes within three months and the check’s price comes off them.
What NIS2 asks
NIS2 covers essential and important entities in eighteen sectors across the EU, and, through them, the companies that supply them.
10kinds of measures in Article 21, from risk analysis and incident handling to backups, supply-chain security, multi-factor authentication and encryption
24 hoursto send the first warning of a significant incident, under Article 23
€10 millionor 2% of worldwide turnover, the fine ceiling for essential entities; €7 million or 1.4% for important ones (Article 34)
Source: Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23 and 34.
Management approves the measures, oversees them and answers for them (Article 20). Each country sets the detail in its own law: in Romania, DNSC’s Order 1/2026 lists 218 measures across three levels. Regulated companies must look after their supply chain too (Article 21(2)(d)), so their suppliers now get security questionnaires of their own.
For your IT team: the detail
What every check includes, and the fixes most organisations need, each a fixed piece of work.
01
Each technical measure, checked
On your systems, against your last audit’s answers if you have one, with what we saw and where. We read and record, and change nothing.
02
A score for each measure
On the maturity scale your country uses, by the measure’s code, ready for your self-assessment.
03
The fixes, in order
What to close first, each fix with a fixed price, and the governance measures (policies, roles, training) listed for you or your consultant.
The fixes, at fixed prices
MFA and single sign‑on for every account
Every person and every administrator behind a second factor, hardware keys for the administrators, and access that ends on the day someone leaves.
from €3,900
Logs kept, watched and answered
Logs from servers, network and cloud in one place, alerts for the attacks that matter, someone who answers them, and the retention you set.
from €4,900
Backups that come back
Copies an attacker cannot delete, a restore tested and timed, and the result on the record.
from €3,900
Every system listed and up to date
The inventory, the flaws attackers already use found and fixed first, and a routine that keeps it that way.
from €4,900
Microsoft 365 or Google Workspace, hardened
Sign-in rules, sharing, mail protection (SPF, DKIM and DMARC) and administrator roles, set to a written baseline.
from €2,900
Starting prices cover up to 100 people and 20 servers. Larger estates are quoted from the check.
Working with a NIS2 consultant
Your consultant writes the policies, the roles and the risk assessment. We make the technical measures hold on your systems, and hand your consultant the evidence for each one.
For consultants. If your clients need the technical half done, we take it on under your engagement or beside it, and you keep the relationship. Write to us.
The same work, under other names. These measures also answer ISO 27001’s controls, cyber insurance questionnaires, and the security questions regulated customers send their suppliers.
Start with what applies to you
Send us your sector and size. Within two working days we reply with what NIS2 asks of you. Free, and with no call.
- FreeWhat applies to you. In two working days, by email.
- FixedThe check. Its price comes off the fixes.
- FixedThe fixes. Each one priced before it starts.
- MonthlyKept in order. With the evidence each month.