The NIS2 audit starts at €2,000, depending on the man-days the auditor estimates. The technical measures have public prices: PenTest from €31 per IP per month, SOC from €10 per protected device per month, Proton Business from €12.99 per user per month. Coordinating compliance and the NIS2 security officer role, through CIO-as-a-Service, from €100 per hour. Prices are in euro and exclude VAT.
What the cost is made of
NIS2 compliance has four cost components, and not all of them are due in the same year.
- Assessment, self-assessment and documentation
- The risk level assessment under DNSC Order 2/2025, the annual self-assessment of the measures under DNSC Order 1/2026 and the policies required by art. 13 of OUG 155/2024. You can do them in-house, with your people’s time, or with an external CIO, by the hour.
- The audit
- Mandatory for essential and important entities, performed by a DNSC-certified auditor independent of your security providers. The entity bears the cost, including for an ad-hoc audit requested by DNSC (art. 46).
- Technical measures
- Whatever is missing after the self-assessment: testing, monitoring, encryption, backup, multi-factor authentication. This is where budgets differ most, because they depend on what you already have.
- Coordination and the NIS2 officer
- Someone keeps the calendar, writes the policies, prepares the audit and answers DNSC. The law requires designating an officer within 30 days of the DNSC decision. In-house or outsourced.
The audit: from €2,000
The auditor estimates the man-days from the entity’s risk level, the number of systems and sites, and how ready the documentation is. An audit at an entity with a single site and written policies starts at €2,000. More sites, operational technology or documentation written during the audit mean more days and a higher price.
You contract directly with the DNSC-certified auditor. TRU does not audit or certify, because the law requires the auditor to be independent of security providers. The details are in the NIS2 audit guide.
Technical measures: public prices
| Measure | Starting price | What it covers in NIS2 |
|---|---|---|
| Internal PenTest | from €31 per IP per month | assessing the effectiveness of measures, vulnerability handling (art. 13 (b) and (e)) |
| External PenTest | from €313 per IP, with monthly testing | internet exposure, testing evidence for the audit |
| SOC 24/7/365 | from €10 per protected device per month | incident detection and handling, notification on time (art. 13 (g)) |
| Proton Business | from €12.99 per user per month, billed annually | encryption of data in transit and at rest, multi-factor authentication (art. 13 (c) and (j)) |
For more detail on testing prices, see how much a pentest costs.
Coordination and the NIS2 officer: from €100 per hour
Through CIO-as-a-Service you pay for the hours used, from €100 per hour: the risk level assessment, the self-assessment, the policies and procedures, the remediation plan, audit preparation and the relationship with DNSC. For the role of outsourced NIS2 security officer, we agree a number of hours per month, with an appointment decision and a written mandate.
The comparison with an employee is simple: an experienced specialist costs more per month than the hours an important entity needs in an ordinary year, without incidents.
What lowers and what raises the cost
| Lowers the cost | Raises the cost |
|---|---|
| Documentation written before the audit, with owners and evidence | Policies written during the audit, on auditor man-days |
| Asset inventory and risk list kept current | Unknown systems discovered during the audit |
| A single site, a single network | Several sites, operational technology, unassessed critical suppliers |
| Measures with public prices, on subscription | Emergency remediation, after an incident or a DNSC decision |
| A correctly assessed risk level | An assurance level higher than the real one, with extra controls |
How TRU helps
We tell you in 30 minutes what budget to expect, based on your risk level, the number of sites and systems. We coordinate through CIO-as-a-Service, deliver the technical measures through PenTest, SOC and Proton Business, and the audit is performed by DNSC-certified auditors, TRU partners, under a direct contract.
If you want a first picture without any conversation, the free NIS2 maturity calculator shows you in a few minutes where you stand.
Sources
OUG 155/2024, consolidated text (in Romanian), art. 11, 13, 14, 46 and 57 · DNSC Order no. 1/2026 · TRU prices valid from October 2026, in euro, excluding VAT.