# CloudSoul

> Cybersecurity compliance, start to finish. Model your business, see what is missing in priority order, and close the gaps. End to end for NIS2 and ISO 27001; CIS, DORA, GDPR and TISAX are covered by the framework mapping.

CloudSoul is a Luxembourg-headquartered SaaS for European mid-market organisations. It works in four steps: model, list gaps, close it, prove it. Risk and Compliance (Pillar 1) models the business and the IT estate, ranks what is missing, and turns every action into audit-ready evidence. As the company grows, what you hold still describes it, rather than becoming a folder of documents that stopped being true.

You close some items on the gap list directly: write a policy, run training, assign an owner. The rest is technical. Security Operations (Pillar 2) is the baseline security tooling that closes those technical items. It is already in the platform, available when the gap list calls for it, and it requires Pillar 1, because you cannot close gaps you have not found. Same platform, same evidence engine, no second vendor and no integration project.

The platform is automated: findings are triaged against your business context, your IT estate and the risks already on your register, then reach the person you designate with a recommended action. Two offers add human judgement on top: the Security Audit, a one-off independent audit where automation collects and a vCISO validates, prioritises and writes the recommendations across three meetings, and vCISO support, a named security lead in three packages (Start, Grow, Mature) plus one-off setup engagements.

Hosted on EU-owned infrastructure, not an EU region of a US-owned provider. No US Cloud Act exposure. Models are open source, running on our own hardware or served by European providers. Customer data is never used to train a model.

## Product

- [Platform](https://www.cloudsoul.net/platform): The two pillars, start to finish, and how they share one profile and one evidence engine.
- [Risk and Compliance](https://www.cloudsoul.net/platform#risk-and-compliance): Business + IT profile, ranked gap list, risk register, policy library, framework mapping (NIS2, ISO 27001, CIS, DORA, GDPR, TISAX), evidence engine and reports. The roadmap is built from your sector, estate, existing tooling, risk appetite and deadline, not pulled from a template.
- [Security Operations](https://www.cloudsoul.net/platform#security-operations): Baseline security tooling, available in the platform and switched on when the gap list calls for it. Continuous threat detection (SIEM + EDR), exposure management (CSPM + vulnerability and patch oversight), resilience (backup + BCP/DRP). Runs from the day you switch it on, with no stack for you to host and nothing to configure, and adapts to your estate automatically. Endpoint detection uses an agent on covered machines. Requires Risk and Compliance.
- [Pricing](https://www.cloudsoul.net/pricing): No published prices. Annual contracts, monthly billing, sized by employee band (no per-seat). Three inputs shape the quote: employee band, enabled modules, advisory days. Exact numbers on the first call, and a written offer within 24 hours.

## Solutions

- [NIS2 compliance](https://www.cloudsoul.net/solutions/nis2): Article 20 (management accountability), Article 21 (risk-management measures), Article 23 (incident reporting). Each obligation mapped to a CloudSoul capability. On Article 23, the platform aggregates the incident detail, proposes a significance classification for you to confirm, formats the notification submission-ready, tracks the 24h, 72h and one-month deadlines and flags each one before it falls due. You submit to your CSIRT or competent authority; CloudSoul does not file or report on your behalf.
- [ISO 27001](https://www.cloudsoul.net/solutions/iso-27001): From gap analysis to audit. The building blocks of the standard, the four steps of working with CloudSoul, and the questions buyers ask.
- [Security Audit](https://www.cloudsoul.net/solutions/security-audit): The standalone audit engagement. Three meetings (kickoff, information review, result delivery); automation collects, pre-analytics weighs findings against the business profile, a vCISO validates, prioritises and writes the recommendations. Deliverable: a ranked gap list usable as the starting roadmap.
- [vCISO](https://www.cloudsoul.net/solutions/vciso): A named security lead who owns the roadmap, runs risk decisions, maintains policies, reports to management, supports audits and answers customer questionnaires. Packages: Start, Grow, Mature. One-off setup engagements for ISMS builds and certification paths.
- [IT and software](https://www.cloudsoul.net/solutions/ict): The industry page for companies that build and run software, in scope themselves or answering their customers.
- [Energy and heat networks](https://www.cloudsoul.net/solutions/energy): The industry page for heat networks and decentralised energy, covering the IT estate alongside the OT already in place.
- [Space](https://www.cloudsoul.net/solutions/space): The industry page for satellite operators, ground segment, suppliers and space data companies, where security requirements arrive through primes, tenders and standards, mapped to one control set.

## Resources

- [NIS2 scope checker](https://www.cloudsoul.net/resources/tools/nis2-checker): Free tool. Three clicks: sector, headcount, turnover. Tells you whether NIS2 applies to you, and whether you would be an essential or an important entity.
- [Blog](https://www.cloudsoul.net/resources/blog): Long-form articles on NIS2, ISO 27001, DORA, supply-chain risk, sector-specific guides.
- [Case studies](https://www.cloudsoul.net/resources/case-studies): Customer outcomes with measurable metrics.

## Blog posts

- [NIS2 registration with the ILR: who must register, what to submit and what happens next](https://www.cloudsoul.net/resources/blog/nis2-ilr-registration-luxembourg): Entities in scope of Luxembourg's NIS2 law register themselves with the ILR through its self-registration form. The deadline was 10 July 2026. What the form asks for, how the ILR confirms your status, and what follows.
- [NIS2 incident notification in Luxembourg: what to report to the ILR, when, and a template](https://www.cloudsoul.net/resources/blog/nis2-incident-notification-luxembourg): In Luxembourg, significant incidents go to the ILR through the SERIMA form: a preliminary notification within 24 hours, an incident notification within 72 hours and a final report within a month. What counts as significant, what each report contains, and a template.
- [ISO 27001 certification in Luxembourg: the process, accredited bodies, cost and local rules](https://www.cloudsoul.net/resources/blog/iso-27001-certification-luxembourg): ISO 27001 certification in Luxembourg works as it does everywhere: an ISMS, about three months of evidence and a two-stage audit by an accredited body. What is local: OLAS accreditation, the NIS2 law's reference to standards, and PSDC archiving status.
- [Security annex in supplier contracts: what each clause asks for, and how to answer it](https://www.cloudsoul.net/resources/blog/security-annex-clause-by-clause): A security annex turns your customer's security requirements into contract terms with a clock, an audit right and a consequence. Its core is usually the eight supplier contract points in Regulation (EU) 2024/2690. Ten clauses, what each costs, what to negotiate, and a checklist.
- [vCISO first 90 days: the plan for a part-time security owner](https://www.cloudsoul.net/resources/blog/vciso-first-90-days): A vCISO or part-time security owner's first 90 days should produce four things you can prove, not forty policies. The six fifteen-day phases, what to refuse, and the four yes-or-no tests that tell you at day 90 whether it worked.
- [Ground segment security: what a satellite operator checks before giving a supplier access](https://www.cloudsoul.net/resources/blog/ground-segment-access-what-operators-check): Before a supplier gets into a ground segment, the operator checks who will have access, how they connect and what that access can reach. The six areas of the review, where they come from under NIS2, the EU Space Act proposal, and what to build first.
- [ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples](https://www.cloudsoul.net/resources/blog/iso-27001-surveillance-audits-year-two-and-three): An ISO 27001 surveillance audit happens at least once a calendar year, the first within 12 months of certification, and takes about a third of the initial audit time. What it must cover, what the auditor samples, and what happens when it goes wrong.
- [ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system](https://www.cloudsoul.net/resources/blog/adding-iso-27001-when-you-already-have-iso-9001): ISO 9001 and ISO 27001 share the Harmonized Structure, so a quality system already runs most of what ISO 27001 needs. What transfers, what is new (risk treatment, the SoA, 93 controls), how integrated audits and audit time work, and what ISO 9001:2026 changes.
- [ISO 27001 risk register: what it must contain, a template, and what auditors check](https://www.cloudsoul.net/resources/blog/the-risk-register-that-survives-an-audit): ISO 27001 requires every risk to have an owner, a level scored against your own criteria, a treatment, and the owner's acceptance of what remains. What the register must contain, a copyable template, and what auditors check first.
- [Cybersecurity requirements for space suppliers: NIS2, the proposed EU Space Act, ESA and prime contractors](https://www.cloudsoul.net/resources/blog/space-suppliers-four-regimes): Most space suppliers get cybersecurity requirements through customers, not regulators. What NIS2 covers in the space sector, what the proposed EU Space Act would add, what ESA, EU programme and prime contracts ask, which comes first, and what to build once.
- [Who is responsible for cybersecurity in an SME? (and when a vCISO makes sense)](https://www.cloudsoul.net/resources/blog/who-is-responsible-for-cybersecurity-sme): Management is accountable, and one named person has to own the decisions. NIS2 puts approval and oversight on the management body, ISO 27001 requires the roles to be assigned, and neither requires a CISO. Where the job lands by default, what it involves, and when a vCISO fits.
- [How to answer a customer security questionnaire: CAIQ, SIG, VSA and the three questions behind them](https://www.cloudsoul.net/resources/blog/security-questionnaire-how-to-answer): Answer the three questions behind every row once, from a library keyed to your controls. A CAIQ of around 260 questions then takes 2 to 4 days, not 2 to 3 weeks. The formats, why inconsistent answers lose deals, what ISO 27001 pre-answers and what to ask back.
- [NIS2 for telecom suppliers: the two ways the obligations reach you, and what operators will ask for](https://www.cloudsoul.net/resources/blog/telecom-suppliers-nis2-obligation-lands-on-you): NIS2 reaches telecom suppliers in two ways: through the operator's contracts, because operators must manage direct supplier risk, and directly if you are a medium-sized or larger MSP, cloud or data centre provider. Both routes, what operators ask for, what to build.
- [CRA reporting obligations: what manufacturers must report since 11 September 2026, to whom and how fast](https://www.cloudsoul.net/resources/blog/cyber-resilience-act-reporting-starts-11-september): Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents in their products: early warning in 24 hours, notification in 72 hours, then a final report. What counts, who receives it, and how NIS2 fits.
- [EASA Part-IS explained: who it applies to, the deadlines, and what it means for aviation suppliers](https://www.cloudsoul.net/resources/blog/easa-part-is-what-it-means-for-aviation-suppliers): EASA Part-IS requires aviation organisations to run an ISMS for information security risks to aviation safety. It has applied since 16 October 2025 or 22 February 2026, depending on the organisation. Who is in scope, what it requires, the NIS2 overlap and what suppliers must do.
- [Does ISO 27001 make you secure? What a certificate proves, what it leaves open, and how to check one is real](https://www.cloudsoul.net/resources/blog/certified-is-not-secure): Not on its own. An ISO 27001 certificate proves a certification body audited your management system for a stated scope. It does not prove the controls work well. What it proves, where it stops, and how to check a certificate is genuine.
- [ISO 27001 vs NIS2: how the two map, and how to do both once](https://www.cloudsoul.net/resources/blog/iso-27001-vs-nis2): An ISO 27001 ISMS covers roughly 70 to 80 per cent of NIS2 Article 21: five of the ten measures fully, five partly. The mapping table, where partial bites, the five NIS2 obligations no ISMS contains, and how to run both as one programme.
- [ISO 27001 audit evidence: what auditors ask for, and how to collect it without the pre-audit scramble](https://www.cloudsoul.net/resources/blog/evidence-that-assembles-itself): ISO 27001 auditors sample dated records from across the audited period, not a snapshot taken the month before. What the standard requires as documented information, typical evidence per control area, how fast it goes stale, and how to collect it as the work happens.
- [ISO 27001 Stage 1 vs Stage 2 audit: what the auditor checks and what they accept](https://www.cloudsoul.net/resources/blog/iso-27001-stage-1-and-stage-2-audits): Stage 1 reads your ISMS documents to check the system is designed. Stage 2 tests whether it actually ran, after around three months of operation. What the auditor checks at each stage, what they accept, and what a major or minor nonconformity costs you.
- [ISO 27001 certification cost for SMEs (2026): audit fees, consultants and the costs nobody quotes](https://www.cloudsoul.net/resources/blog/iso-27001-cost): For a company of 26 to 125 people, ISO 27001 costs roughly €50,000 to €150,000 in year one, all in. The certification audit is the smallest line. Every cost, the three-year view, and where the money is wasted.
- [ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check](https://www.cloudsoul.net/resources/blog/iso-27001-internal-audit-and-management-review): ISO 27001 requires internal audits (9.2) and management reviews (9.3) at planned intervals. No frequency is set, but every certification visit checks both, so in practice they run at least yearly. What each clause requires, the seven review inputs and what auditors raise.
- [ISO 27001 Annex A controls: the 93 controls in 4 themes, grouped the way you will actually implement them](https://www.cloudsoul.net/resources/blog/iso-27001-annex-a-controls-grouped-for-real-work): ISO 27001:2022 Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34), 11 of them new. The full list, what changed from 2013, and a grouping by the kind of work each control needs.
- [How long does ISO 27001 certification take? The timeline by phase, and what slows it down](https://www.cloudsoul.net/resources/blog/iso-27001-how-long-it-really-takes): Plan for nine to twelve months if you are starting from scratch. Where every month of an ISO 27001 project goes, the three-month evidence period that cannot be compressed, why Stage 2 audits get moved, and what genuinely shortens it.
- [ISO 27001 scope and Statement of Applicability: how to write them](https://www.cloudsoul.net/resources/blog/iso-27001-scope-and-statement-of-applicability): The ISO 27001 scope is the boundary of your management system and appears on the certificate. The Statement of Applicability lists all 93 Annex A controls and is what you are audited against. How to draw the scope, justify exclusions and keep both current.
- [ISO 27001 without a security team: what a small company has to decide, build and run](https://www.cloudsoul.net/resources/blog/iso-27001-without-a-security-team): A small company with no security team can pass ISO 27001, because it certifies a management system, not a security score. Who does what, the decisions only you can make, the documents and 93 controls, a nine-to-twelve-month timeline, and what the certificate leaves open.
- [NIS2 and ransomware: what you must report, whether you can pay, and what Article 21 expects](https://www.cloudsoul.net/resources/blog/nis2-ransomware): Ransomware that can severely disrupt your services is a significant NIS2 incident: early warning within 24 hours, notification within 72. NIS2 does not ban paying. Reporting, payment, the COM(2026) 13 proposal, Article 21, GDPR and a first-24-hours checklist.
- [NIS2 supply chain security: how to assess supplier risk under Article 21](https://www.cloudsoul.net/resources/blog/nis2-supply-chain-risk-assessment): NIS2 makes supply chain security one of the ten minimum measures. You must assess each direct supplier's vulnerabilities, product quality and security practices, and take EU coordinated assessments into account. The steps, the contract clauses and what Article 22 adds.
- [Does NIS2 apply to SMEs? Who is in scope, and what smaller suppliers still have to do](https://www.cloudsoul.net/resources/blog/nis2-sme-compliance): NIS2 applies to medium-sized and large companies in the sectors it lists: 50 or more employees, or more than EUR 10 million in both turnover and balance sheet. Small companies are mostly out of scope, but their NIS2-regulated customers pass the requirements on.
- [NIS2 encryption requirements: what Article 21 asks for cryptography, and when encryption is expected](https://www.cloudsoul.net/resources/blog/nis2-encryption-telecom): NIS2 requires every essential and important entity to have a cryptography policy, and encryption where appropriate to the risk. What Article 21(2)(h) says, what Regulation 2024/2690 adds, a policy outline, key management, post-quantum plans and the telecom rules.
- [NIS2 for the food sector: which food businesses are in scope (wholesale, processing, production)](https://www.cloudsoul.net/resources/blog/nis2-food-sector-wholesale-processing): NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, if medium-sized or larger. Who is in and out, from dairies and drinks makers to retailers, restaurants and farms, essential or important, and what applies.
- [NIS2 Article 28: domain registration data (WHOIS) obligations for registries and registrars](https://www.cloudsoul.net/resources/blog/nis2-whois-domain-registry-obligations): NIS2 Article 28 requires TLD registries, registrars and resellers to keep accurate and complete domain registration data, verify it, publish non-personal data and answer access requests within 72 hours. Scope, data fields, GDPR and a verification checklist.
- [NIS2 in Germany: what the NIS2UmsuCG and the new BSIG require, who is in scope and the BSI deadlines](https://www.cloudsoul.net/resources/blog/nis2-germany-implementation-law): NIS2 has applied in Germany since 6 December 2025 through the NIS2UmsuCG and a new BSIG. Who is in scope under § 28, the § 33 registration deadline that has passed, § 32 reporting, § 30 measures, § 38 management duties and § 65 fines, mapped to NIS2.
- [NIS2 training requirements: who must be trained, on what, and how often](https://www.cloudsoul.net/resources/blog/nis2-training-requirements-board-employees): NIS2 requires members of the management body to follow cybersecurity training and makes staff training a minimum risk-management measure. It sets no hours, certificate or approved provider. What the law says, what the implementing rules add, a training plan and a record template.
- [NIS2 in Belgium: what the law of 26 April 2024 requires, who is in scope and the CCB deadlines](https://www.cloudsoul.net/resources/blog/nis2-belgium-implementation-law): Belgium's NIS2 law, the Law of 26 April 2024, has applied since 18 October 2024, with the CCB as national authority. Scope, Safeonweb@work registration, incident reporting, the CyberFundamentals and ISO 27001 routes, the 2026 and 2027 deadlines, and fines.
- [NIS2 jurisdiction: which Member State supervises you, and how the main establishment rule works](https://www.cloudsoul.net/resources/blog/nis2-jurisdiction-main-establishment): Under NIS2 you are supervised by the Member State where you are established. Telecoms answer to each country they serve; cloud, MSP and other digital providers to their main establishment. The rules, the main establishment test, non-EU providers, mutual assistance and groups.
- [NIS2 in Luxembourg: the Law of 5 May 2026 explained (scope, ILR registration, reporting and fines)](https://www.cloudsoul.net/resources/blog/nis2-luxembourg-implementation-law): Luxembourg transposed NIS2 through the Law of 5 May 2026, in force since 10 May 2026. Who is in scope, how to register with the ILR, the ten Article 12 measures, the 24-hour reporting clock and fines of up to EUR 10 million or 2% of turnover.
- [NIS2 coordinated vulnerability disclosure: what Article 12 sets up, and what your company must do about vulnerabilities](https://www.cloudsoul.net/resources/blog/nis2-vulnerability-disclosure-framework): NIS2 Article 12 makes one CSIRT per country the coordinator for vulnerability reports and has ENISA run a European vulnerability database. Article 21 makes companies handle and disclose vulnerabilities. What each means, the CRA link and a policy template.
- [NIS2 manufacturing: which manufacturers are in scope (NACE C26 to C30 and medical devices)](https://www.cloudsoul.net/resources/blog/nis2-manufacturing-sector): NIS2 covers makers of medical devices and IVDs and of products in NACE Rev. 2 divisions 26 to 30, from 50 staff or over EUR 10 million turnover and balance sheet. What each division covers, automotive suppliers, car dealers, status and duties.
- [NIS2 for financial services: when DORA applies instead, and where CER fits](https://www.cloudsoul.net/resources/blog/nis2-financial-sector-dora-relationship-banking): NIS2 lists only banks, trading venue operators and CCPs, and even for them DORA replaces the NIS2 risk and reporting rules. Insurers, investment firms, payment institutions and fund managers follow DORA alone. Who follows what, DORA's deadlines, and where CER fits.
- [NIS2 certification: is there a NIS2 certificate, and what counts as proof?](https://www.cloudsoul.net/resources/blog/nis2-cybersecurity-certification-standards-iso-27001): There is no NIS2 certificate for companies. NIS2 lets authorities require certified ICT products (Article 24), encourages standards such as ISO 27001 (Article 25) and audits entities (Articles 32 and 33). What exists, what is proposed, and what an auditor asks for.
- [NIS2 for MSPs and MSSPs: are managed service providers in scope, and what applies?](https://www.cloudsoul.net/resources/blog/nis2-msp-mssp-managed-service-providers-regulated): Managed service providers and managed security service providers are an Annex I sector under NIS2. If you are medium-sized or larger, you are in scope: important if medium, essential if large. What applies, which country supervises you, what to register and report.
- [NIS2 vs GDPR: the differences, where they overlap, and how to handle one incident under both](https://www.cloudsoul.net/resources/blog/nis2-gdpr-overlap-cybersecurity-data-protection): GDPR protects personal data; NIS2 protects the systems behind essential and important services. One incident can trigger both: a NIS2 early warning within 24 hours and a GDPR notification within 72. Side-by-side table, fines, a worked example and a joint playbook.
- [What is a significant incident under NIS2? The legal test, the thresholds for digital providers, and how to decide fast](https://www.cloudsoul.net/resources/blog/nis2-significant-incident-reporting-threshold-definition): Under NIS2 Article 23(3), an incident is significant if it causes or can cause severe operational disruption or financial loss for you, or considerable damage to others. The legal test, who decides, the thresholds for digital providers, a decision tree and the GDPR difference.
- [NIS2 for transport: which air, rail, water and road operators are in scope and what applies](https://www.cloudsoul.net/resources/blog/nis2-transport-aviation-rail-maritime-road): NIS2 covers transport operators of an Annex I type that are at least medium-sized: air carriers, airports, air traffic control, rail, shipping, ports, VTS, road authorities and ITS operators. Who is in and out, essential or important, and how Part-IS, ISPS and CER fit.
- [Who enforces NIS2? Competent authorities, CSIRTs and the EU bodies behind them](https://www.cloudsoul.net/resources/blog/nis2-institutional-architecture-csirts-authorities): NIS2 is enforced by national competent authorities; incident reports go to a national CSIRT or the authority. What each national and EU body does, which ones a company deals with, how to find yours, and what the 2026 proposal would change for ENISA.
- [NIS2 fines and penalties: how much, for what, and what else regulators can do](https://www.cloudsoul.net/resources/blog/nis2-administrative-fines-eur-10-million-penalties): For breaches of Article 21 or 23, national law must set NIS2 fines with a maximum of at least €10M or 2% of worldwide turnover for essential entities and €7M or 1.4% for important ones. What triggers them, group turnover, GDPR, other powers and personal liability.
- [NIS2 for healthcare: which hospitals, clinics, labs and pharma companies are in scope](https://www.cloudsoul.net/resources/blog/nis2-healthcare-hospitals-pharma-compliance): NIS2 covers healthcare providers, pharma R&D and manufacturing, and medical device makers once they have 50 staff, or turnover and balance sheet both over €10 million. Clinics, radiology, labs, pharmacies and pharma, essential or important, and what applies.
- [NIS2 all-hazards approach: what it means for physical and environmental security](https://www.cloudsoul.net/resources/blog/nis2-all-hazards-approach-physical-security): NIS2 Article 21(2) requires measures based on an all-hazards approach that protects network and information systems and their physical environment. The hazards the recitals name, the rules for digital providers, the link with the CER Directive and a proportionate SME baseline.
- [NIS2 digital infrastructure: what applies to cloud, data centre, DNS, CDN and IXP providers](https://www.cloudsoul.net/resources/blog/nis2-digital-infrastructure-cloud-data-centre): NIS2 Annex I names nine digital infrastructure entity types. DNS, TLD, trust service and telecom providers are covered at any size; cloud, data centre, CDN and IXP providers from medium size. Definitions, status, jurisdiction, incident thresholds and a checklist.
- [NIS2 essential vs important entities: how you are classified and what changes for you](https://www.cloudsoul.net/resources/blog/nis2-essential-important-entities-comparison): Large Annex I entities and a few named categories are essential; other in-scope Annex I and II entities are important. Both follow the same Articles 20, 21 and 23. Supervision, enforcement and fines differ. How classification works, and what changes for you.
- [NIS2 for the energy sector: which operators are in scope and what applies (electricity, gas, oil, hydrogen, heating)](https://www.cloudsoul.net/resources/blog/nis2-energy-sector-compliance-guide): NIS2 applies to electricity, district heating and cooling, oil, gas and hydrogen operators of an Annex I type that are at least medium-sized; large ones are essential. Scope by subsector, oil and gas, the electricity network code, the CER Directive and OT in practice.
- [NIS2 incident reporting timeline: 24 hours, 72 hours, one month, and what goes in each report](https://www.cloudsoul.net/resources/blog/nis2-incident-reporting-timeline-guide): NIS2 gives you 24 hours from becoming aware of a significant incident for an early warning, 72 hours for the incident notification and one month after that for the final report. What each report contains, who receives it, telling customers, and a timeline to copy.
- [NIS2 board duties: what Article 20 requires from management, and when directors can be held liable](https://www.cloudsoul.net/resources/blog/nis2-board-accountability-governance): Under NIS2 Article 20 the management body approves the Article 21 measures, oversees their implementation and can be held liable; its members must follow training. What each duty means, whether approval can be delegated, who is liable, and a board-pack template.
- [NIS2 Article 21: the 10 cybersecurity risk-management measures, explained](https://www.cloudsoul.net/resources/blog/nis2-article-21-10-measures): Article 21 of NIS2 requires appropriate and proportionate measures to manage cybersecurity risk, based on an all-hazards approach, and lists ten minimum measures. What each one means in practice, what proportionate means, and what evidence an authority will ask for.
- [NIS1 vs NIS2: the key differences, side by side](https://www.cloudsoul.net/resources/blog/nis1-vs-nis2-key-differences): NIS2 replaced NIS1 on 18 October 2024. The biggest change is scope: NIS1 covered operators each country chose in 7 sectors, NIS2 applies by size in 18 sectors. It adds ten minimum measures, management liability, a 24-hour clock and fine ceilings. The comparison table.
- [NIS2 scope: does NIS2 apply to your company? A four-step check](https://www.cloudsoul.net/resources/blog/nis2-scope-applicability-guide): NIS2 applies to entities of a type listed in Annex I or II that are at least medium-sized and active in the EU, plus a short list covered regardless of size. The four-step check, a decision table, the size rules, exclusions and registration.
- [NIS2 compliance: what the directive requires, who is in scope, and where to start](https://www.cloudsoul.net/resources/blog/nis2-compliance-ultimate-guide): NIS2 applies to medium-sized and larger entities in 18 sectors. Compliance means registering, board approval and training, ten minimum security measures and incident reporting within 24 hours. Who is in scope, each duty, fines, national laws and a 90-day plan.
- [Is ISO 27001 worth it? When the certificate pays for itself, and when it does not](https://www.cloudsoul.net/resources/blog/is-eu50k-for-iso27001-worth-it): ISO 27001 is worth it when a tender or a customer already asks for it, or when NIS2 applies to you: the certificate is then a cost of revenue. What it buys, how to weigh the €50,000 to €150,000 first year, when it is not worth it yet, and how to get the same result for less.

## Case studies

- [Inside InWarmte's regulatory compliance journey](https://www.cloudsoul.net/resources/case-studies/inside-inwarmtes-regulatory-compliance-journey): InWarmte exclusively supplies sustainable and environmentally friendly energy from thermal energy storage systems, heat pumps and solar energy systems. InWarmte works with their clients to find the best solutions for both new and existing buildings. InWarmte offers support in the development, implementation and operation of these systems.
- [Scaling fast without compromising security](https://www.cloudsoul.net/resources/case-studies/scaling-fast-without-compromising-security): Elora is redefining how businesses leverage artificial intelligence. For years, employees across industries have been burdened with repetitive tasks: customer service inquiries, routine phone support, and help desk tickets, that consume valuable time and resources. These tasks are costly, time-intensive, and often lead to frustration among workers who could otherwise focus on higher-value activities.

## Company

- [About](https://www.cloudsoul.net/company): Mission, team, contact.
- [Trust centre](https://www.cloudsoul.net/trust-centre): CloudSoul's own security posture, certifications, sub-processors.

## Contact

- Sales: sales@cloudsoul.net
- Security: security@cloudsoul.net
- Press: press@cloudsoul.net
- General: info@cloudsoul.net

## Localised versions

The site is published in English (default), French (/fr/), and German (/de/). Most pages are available in each locale (replace the path prefix to switch); the ISO 27001, Security Audit, vCISO and industry pages are English-only.

## Optional

Legal pages, included for completeness. Skip if context is tight.

- [Terms of use](https://www.cloudsoul.net/policies/terms-of-use)
- [Privacy](https://www.cloudsoul.net/policies/privacy)
- [Cookies](https://www.cloudsoul.net/policies/cookie)
- [Acceptable use](https://www.cloudsoul.net/policies/acceptable-use)
- [Refund](https://www.cloudsoul.net/policies/refund)