Pricing · 2026 breakdown

How much does a NIS2 audit cost?

Short answer: anywhere from €39 to €50,000, depending on how much of the work is human judgment versus automatable checks. A consultant who assesses your policies, training, and supply chain bills five figures. The external-posture portion, which is what a BSI auditor or enterprise buyer looks at first, is deterministic and costs a fraction of that. Here is where every euro goes, and how to avoid paying consultant rates for things a scan covers.

Scan your domain free (60s) €39 Audit Pack

Where the money goes

Cost line	Typical range	What you get
External consultant audit	€10,000 - €50,000	A security firm runs a point-in-time assessment and writes a report. Thorough, but it is a snapshot and it recurs every audit cycle.
GRC platform (Vanta, Drata, Sprinto)	€5,000 - €50,000 / year	Automates internal-control evidence (policies, attestations). Strong for SOC 2 / ISO, priced per headcount, annual contract. Most do not foreground NIS2 on their pricing page.
Penetration test	€4,000 - €15,000	Deep manual testing once or twice a year. Required for some buyers, but expensive and infrequent for the external-posture basics.
Internal staff time	20 - 80 hours	Someone on your team maps Article 21 measures, gathers evidence, and chases certificates. Real cost even when no invoice is attached.
SaaSFort external scan	€9 / mo or €39 one-time	66 checks across 25 categories mapped to NIS2 Article 21 and ISO 27001 Annex A. Auditor-addressed PDF in 60 seconds. Not a replacement for a pentest, but it covers the external posture an auditor looks at first.

Common confusion

"A NIS2 audit is one big invoice, like a certification."

Not quite. NIS2 is an ongoing legal obligation, not a certificate you buy once. The cost splits into a recurring external-posture check (cheap, automatable) and periodic internal-control work (expensive, human judgment). The mistake is paying consultant rates to re-verify externally observable basics like TLS, headers, and exposed services. Clear those with a scan first, then spend the consultant budget on policies, training, and supply-chain review where it actually counts.

Clear the external findings for €39, before the consultant arrives

The Audit Pack runs 66 checks mapped to NIS2 Article 21 and ISO 27001 Annex A, gives you 90 days of re-scans, and produces a dated, auditor-addressed PDF. Use it to fix the externally observable basics so you pay consultants for judgment, not for re-checking your TLS config.

Get the €39 Audit Pack Run my free scan first

Frequently asked questions

How much does a NIS2 audit cost for an SMB?

It depends on the route. A consultant-led NIS2 readiness assessment for a 50 to 250 employee company typically runs €10,000 to €50,000, billed per engagement. A GRC platform subscription runs €5,000 to €50,000 per year depending on headcount. The external-posture portion, which is the part an auditor or enterprise buyer checks first, can be covered by a SaaSFort scan at €9 per month or a €39 one-time audit pack. Most teams combine a cheap continuous scan for the external surface with a periodic deeper engagement for the internal controls.

Is there a free way to check NIS2 readiness?

Yes for the externally-observable part. The SaaSFort free scan runs 66 checks against your public domain (TLS, DNS, security headers, exposed admin panels, certificate chain) and grades you A to F, with each finding mapped to a NIS2 Article 21 sub-clause. No card, no signup for the first scan. It will not assess internal policies or staff training, which are the parts a consultant covers.

Why is a consultant audit so much more expensive?

A consultant assesses everything: internal policies, access controls, supplier contracts, incident-response plans, and management-body training records, not just the external surface. That breadth is the value and the cost. The external-posture subset is deterministic and can be automated, which is why a scan covers it for €39 instead of several thousand euros. Use the scan to clear the external findings before the consultant arrives, so you pay them for judgment, not for re-checking your TLS config.

What does the €39 NIS2 Audit Pack include?

A full NIS2 and ISO 27001 control-mapped PDF report, 90 days of re-scans so you can show progress over time rather than a single snapshot, a dated compliance attestation you can attach to a questionnaire or BSI submission, and the 66-check external posture scan. One-time, no subscription, and you can upgrade to a monthly plan anytime if you want continuous monitoring.

Does NIS2 compliance cost recur every year?

The obligation is continuous, so yes, in practice you carry an ongoing cost. Consultant audits recur each cycle. A continuous scan at €9 per month is €108 per year, which is why teams use cheap automated tooling for the external surface and reserve the expensive human engagements for the parts that genuinely need judgment. NIS2 is not a one-and-done certificate; it is a standing legal duty once you are in scope.