NIS2 Compliance Cost Calculator
Compare what the NIS2 documentation work costs in the first year, three ways: an external consultant, our templates adapted by your own team, or templates plus a short consultant review. Every default is either sourced or labelled as our own assumption, and you can change all of them.
Transparency note: nis-2-templates.com sells templates. That is why the consultant figures come from outside sources and every assumption is open for you to change. General information, not legal advice.
Estimated first-year cost of the documentation work
Central estimate with a low–high range. Net amounts in EUR, excluding VAT.
A. External consultant
A consultant runs the gap analysis, plans the measures and drafts and rolls out the documents with you.
Central estimate–Range: –
- Consultant fees
- –
- Your team’s time
- –
- Templates
- –
- Calendar time
- –
B. Templates, adapted by your team
Your team adapts the templates that apply to you, about 2–4 hours each.
Central estimate–Range: –
- Consultant fees
- –
- Your team’s time
- –
- Templates
- –
- Calendar time
- –
C. Templates + short consultant review
Route B, plus a few consultant days to review the adapted set.
Central estimate–Range: –
- Consultant fees
- –
- Your team’s time
- –
- Templates
- –
- Calendar time
- –
Side by side Bars: central estimate. Thin line: low–high range.
Templates used in routes B and C
–
Starting smaller? The Quick-Start Bundle (€249) has 8 core templates covering 7 of the 10 measures. One-time price, net. EU businesses with a valid VAT number pay 0% VAT under the reverse-charge mechanism.
See real pages first
Free 7-page sample PDF: the full file list and the first pages of a real document. We email you a link.
Keep this estimate
Assumptions and sources (all editable)
Every result comes from these values. Sourced values name their source; the rest are our own model assumptions. Change any of them; the copied link keeps your changes.
| Assumption | Value | Source |
|---|---|---|
| Orbiq | ||
| Orbiq | ||
| Our assumption | ||
| Orbiq | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Bundestag 21/1501 (250+ = 2×); other bands our interpolation | ||
| Bundestag 21/1501 (250+ = 2×); other bands our interpolation | ||
| Bundestag 21/1501 (250+ = 2×); other bands our interpolation | ||
| Bundestag 21/1501 (250+ = 2×); other bands our interpolation | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption | ||
| Our assumption |
What no route includes
Technical measures (tools, licences, hardware), external audits and certification, penetration tests, legal opinions, tabletop exercises, audit preparation, and running the measures after the first year. For scale: Germany’s government costs the whole NIS2 effort of a medium-sized important entity at about 963 staff hours and €21,200 in material costs a year, with a similar one-off amount in the first year.
Sources
- German Bundestag, Drucksache 21/1501 (8 Sep 2025), pp. 110–111: compliance-cost estimate for the German NIS2 act. Wage rate €56.08/h; an important entity 1,100 hours and €24,300 a year; large important entities 70% and medium ones 35% of an essential entity’s 2,752 hours.
- Orbiq, “NIS2-Beratung” (in German): gap analysis 3–5 days, measure planning 5–10, implementation support 20–40. Orbiq sells a compliance platform as an alternative to consulting, so read the days as an upper case.
- BDU fee study “Honorare im Consulting” 2022, reported by Produktion: average day rate €1,350 for a junior consultant, €1,950 for a project manager.
- freelancermap, Freelancer-Kompass 2026: median IT-freelancer rate €95 an hour, about €760 for an 8-hour day.
Indicative estimate from the assumptions shown here. It is not a quote, an offer or legal advice, and it does not decide whether NIS2 applies to your organisation. Everyone who enters the same values sees the same result. Templates support the documentation work; they do not by themselves make an organisation compliant, and no outcome of an audit or inspection is guaranteed. Seller: ZILIO Marzena Rewers, Poland. Sales to businesses only.
How the calculator works
- Route A, external consultant. The software vendor Orbiq publishes a phase estimate for NIS2 consulting: gap analysis 3–5 days, measure planning 5–10 days, implementation support 20–40 days. Added up, that is 28–55 consultant days, which the calculator multiplies by your day rate. Your own team still spends time on interviews, reviews and approvals; we assume 1.5 hours per consultant day.
- Route B, templates adapted by your team. Our own assumption: about 40 of the 66 templates in the Complete Toolkit apply to a medium-sized organisation, and each takes 2–4 hours to adapt, agree and approve. That is 80–160 hours at your internal hourly cost, plus the template price.
- Route C, templates plus a short review. Route B, plus a few consultant days (five by default) to check the adapted set before the management body approves it.
- Your organisation. Size, IT/OT complexity, an existing ISO 27001 management system, extra legal entities and extra sites scale routes A and B by the same factors. Your security staff only changes the calendar time, through the hours a week your team can give the project.
What the defaults are based on
| Input | Default | Basis |
|---|---|---|
| Internal cost per hour | €56 | The wage rate of €56.08 that Germany’s government uses to cost the NIS2 work of companies (Bundestag Drucksache 21/1501) |
| Consultant day rate | €1,350 | Average junior-consultant rate in the BDU fee study 2022. Project managers averaged €1,950; the median IT freelancer charges €95 an hour, about €760 a day (freelancermap 2026) |
| Consultant days | 28–55 | Orbiq’s phase estimate for NIS2 consulting, without tabletop exercise and audit preparation (every route needs those) |
| Hours to adapt the templates | 80–160 | Our assumption: about 40 relevant templates at 2–4 hours each |
| Size factor for 1,000+ staff | 2× | The German estimate puts large important entities at 70% and medium ones at 35% of an essential entity’s effort. The 250–999 and under-50 factors are our interpolation |
| Complexity, ISO 27001, entities, sites, team hours a week | see calculator | Our assumptions, listed under “Assumptions and sources” in the calculator |
How to read the result
Trust the ratio between the routes more than the absolute numbers. The ranges are wide because the inputs are: day rates alone differ by a factor of two to three between a freelancer and a consultancy’s project manager. Route A also covers more than documents, since implementation support includes rolling the measures out with you.
None of the routes pays for the largest cost item, the measures themselves. For scale, Germany’s government estimates the whole NIS2 effort of a medium-sized important entity at about 963 staff hours and €21,200 in material costs a year, with a one-off amount of similar size in the first year. Documentation is one part of that.
A consultant is often the better choice when nobody inside can own the project for several months, when the board will challenge scope and risk decisions that need an outside view, or when operational technology brings safety constraints your team has not documented before. Templates give structure and wording; they do not make those judgement calls. Route C exists for that middle ground. For questions to ask a consultant before you sign, see how to choose a NIS2 consultant; for the wider budget, see NIS2 compliance cost by company size.
FAQ
Is the result a quote?
No. It is an indicative estimate from the assumptions shown. For a binding price, ask two or three consultants for written quotes and enter their day rates and days in the calculator.
Does the calculator tell me whether NIS2 applies to us?
No. It assumes you already need the Article 21 documentation. Whether an organisation is in scope depends on its sector, size and national law; the NIS2 applicability checker shows which category organisations like yours typically fall into, and the readiness check helps once scope is settled.
Why is route B so much cheaper than route A?
Because most consultant days in route A go into gap analysis, planning and drafting, and a template set replaces the drafting from a blank page. Your team’s hours do not disappear: route B counts them at your internal cost. If your team has no time at all, the calendar time shows it.
Which costs are not included?
Technical measures such as tools, licences and hardware, external audits and certification, penetration tests, legal opinions, tabletop exercises, audit preparation, and running the measures after the first year.
Are the templates available in my language?
The templates on this site are in English. A German edition aligned with the German BSIG is sold on nis-2-richtlinie.com, and a Polish edition adapted to the KSC Act is available on request. For other languages, the calculator adds translation and review hours to routes B and C.
General information, not legal advice. Last reviewed 29 October 2026.