NIS2 readiness for consultancies and professional services firms

You advise, audit, design, recruit for or represent companies that are essential or important entities. You hold their documents, financials, drawings or personnel data, usually in email and a document system, often on personal laptops and phones.

Scope the NIS2 supplier-readiness assessment Check your domain now NIS2 scope check

Why the questions arrive

Professional services firms are reached entirely through the supply chain: few are in scope themselves, nearly all of their larger clients are. The questions focus on the two things a firm cannot hide: how email is protected (because that is where client data lives) and how laptops and accounts are managed (because that is where it leaks). Clients also ask whether you would tell them if you were breached, and how fast.

What you are asked

The five questions this sector gets

Each with what counts as evidence. A yes without an artefact scores nothing.

Email securitySPF, DKIM, DMARC, MFA on every mailbox, and a rule for sending sensitive documents.
Document storage and sharingWhere client files live, who can open them, how sharing links expire, and backups with a tested restore.
Laptops, phones and home workingEncryption, screen locks, updates, and what happens when a device is lost or a person leaves.
Confidentiality and incident notificationWritten commitments, a named security contact, and how quickly a client would hear about an incident involving their data.
Your own tools and sub-processorsThe cloud services you rely on, where they process data, and whether you have their security statements.

Fix first

Four things to have before the next questionnaire

Cheap, mostly visible from outside, and present in nearly every questionnaire. The rest goes into a dated plan with an owner per item.

Email authentication and MFA on every account
Device encryption and automatic updates
A document retention and sharing rule you can show
A security contact and a one-page incident process

Get the twelve-point checklist (PDF)Read the checklist article

The assessment

NIS2 supplier-readiness assessment

10 working days, fixed scope, written deliverables.

External reconnaissance, authenticated configuration review, email and domain authentication, cloud and hosting posture, and a staff phishing baseline. You receive a written report, a remediation plan ordered by risk, and an evidence pack mapped to the NIS2 themes your customer is asking about.

External attack-surface report
Email authentication
Server and cloud hardening
Web security headers
Remediation plan

Book the scoping call Full scope and method

Questions from this sector

Asked before, answered here

We are a partnership of eight. Nobody has asked us yet.

They will when the next engagement letter is renewed or a tender arrives. The four cheap items take days and are the ones visible from outside. Being ready before the question costs less than answering in a hurry.

Our clients are accountants' clients, not ours. Does it still reach us?

If your client is in scope, their duty to manage supplier risk reaches every supplier with access to their data or systems, including advisers. The scope check indicates which route applies.

Can you run the assessment without disrupting the practice?

Yes. Reconnaissance runs from outside, configuration review uses read-only access, and the phishing baseline is a short, announced test. Nothing is changed without your approval.

Other sectors

Suppliers in other regulated chains

Industry

NIS2 readiness for consultancies and professional services firms

The five questions this sector gets

Four things to have before the next questionnaire

NIS2 supplier-readiness assessment

Asked before, answered here

Suppliers in other regulated chains

Manufacturing and industrial suppliers

Logistics and transport suppliers

IT and software suppliers

Healthcare suppliers