NIS2
Comparison
Updated 23 September 2026
by Victor Mita
NIS2 consultant or platform? What each one does, and what it does not
A comparison of costs, responsibilities and day-to-day work, with the cases where you need a consultant and not us.
A consultant and a platform do not do the same thing. The consultant brings judgement: they interpret the law for your case, take professional responsibility for the opinion and get their hands on your systems. A platform like Epic Assess brings continuity: it keeps measures, documents, evidence and deadlines in order every day, even when the consultant is not there. For many SMEs the most sensible combination is a consultant for the decisive moments and a platform for the rest of the year.
The comparison in one table
Updated 23 September 2026.
| NIS2 consultant | Epic Assess | |
|---|---|---|
| Legal opinion on your case (scope, borderline cases, dealings with ACN, Italy's National Cybersecurity Agency) | Yes, if they are a lawyer or a firm with specific expertise | Stays with your lawyer: the platform gives them data and documents already in order |
| Technical work (MFA, firewall, backups, monitoring) | Yes, if they are also an integrator or an MSP | A plan of the work with owners and deadlines, carried out by your IT team or your suppliers |
| Catalogue of ACN measures and status of each requirement | Usually in a document or a spreadsheet handed over at the end of the engagement | Always up to date, with owners, priorities and deadlines |
| Draft policies | Written to measure | Drafts from templates built on the ACN measures, to complete and have approved |
| Deadlines and renewals | Depends on the contract | ACN calendar and reminders in the platform |
| Incident register and notification windows | Support on call, if agreed | Register with the 24-hour, 72-hour and one-month windows, and pre-filled drafts |
| Inspection pack | To be prepared with them | Exportable at any time |
| Availability | On the days in the contract | Whenever you need it, with no days to use up |
| Cost | By the day or by the project (see below) | Subscription, price tailored to each company |
What a consultant costs
There are no official rates. As an order of magnitude, a trade article of 13 September 2025 gives: €5,000 to 7,500 for basic consultancy for an SME (about 5 days), €3,000 to 5,000 for three days of training, €20,000 to 50,000 a year for ongoing support, up to €100,000 to 200,000 for a full implementation in a large organisation (Edirama). These are estimates from a single firm: always ask for several quotes.
Our price is tailored to each company, with a single plan that covers all of NIS2. We work out the figure together in a demo.
How to use them together
- At the start: the consultant confirms the scope and the category, especially in borderline cases (groups, mixed activities, suppliers).
- During the compliance work: the platform holds the work plan and the evidence; the consultant reviews the most sensitive policies and steps in where technical expertise is needed.
- Over time: annual reviews, updates on the ACN portal, incidents. Here a platform reduces the number of days you need. The consultant can work directly on your data in the platform.
Further reading
The other comparisons:
Sources
The sources are published in Italian.
- D.Lgs. 138/2024, Normattiva
- ACN, "Modalità e specifiche di base" (basic procedures and specifications)
- Edirama, "Direttiva NIS 2: il compenso per una consulenza" (NIS 2 Directive: the fee for a consultancy), 13 September 2025 (accessed 22 September 2026)
- Epic Assess features: status as of 23 September 2026, internal product documentation.