The verdict in three sentences
A mid-sized company classified as an important entity under NIS2 must prove that its critical business applications are protected, monitored and recoverable. For a shipment tracking app, a typical upgrade costs EUR 15,000 to 45,000 excl. VAT and takes 2 to 4 months. Against a fine of up to EUR 7M or 1.4% of worldwide turnover, the project largely pays for itself through avoided risk.
What NIS2 concretely requires from a business application
The directive, transposed nationally (in France through the resilience law, supervised by ANSSI), does not prescribe technologies. It requires proportionate risk management measures. For a web app used by operators, carriers and sometimes customers, that means six workstreams an auditor can verify.
| Measure | What the auditor checks | Typical effort | Indicative 2026 cost |
|---|---|---|---|
| Multi-factor authentication (MFA) | MFA on admin and external accounts, SSO where possible | 5 to 10 days | EUR 3,000 to 7,000 |
| Centralised logging | Timestamped logs, kept 12 months, shipped to a SIEM | 6 to 12 days | EUR 4,000 to 9,000 |
| Vulnerability management | Dependency scanning, critical patches within 15 days | 4 to 8 days + follow-up | EUR 2,500 to 6,000 |
| Continuity plan and backups | Encrypted backups, restore test, documented RTO | 5 to 10 days | EUR 3,000 to 8,000 |
| Access management | Role review, least privilege principle | 3 to 6 days | EUR 2,000 to 5,000 |
| Penetration test | External application pentest and remediation report | 5 to 8 days | EUR 5,000 to 10,000 |
Order matters. MFA and logging close the two most exploited doors (stolen credentials, undetected attacks). The pentest comes last to validate fixes, not to discover known flaws.
Three budget scenarios depending on the starting point
Cost depends mostly on technical debt. A recent app on a maintained framework upgrades quickly. A 10-year-old app without automated tests sometimes needs its authentication rebuilt before MFA can be added.
| Application profile | Duration | Budget excl. VAT | Annual recurring |
|---|---|---|---|
| Recent, up-to-date framework, cloud hosting | 2 months | EUR 15,000 to 22,000 | EUR 4,000 to 6,000 |
| 5 to 8 years old, partly outdated dependencies | 3 months | EUR 22,000 to 35,000 | EUR 6,000 to 9,000 |
| Over 10 years, on-premise hosting, no tests | 4 months | EUR 35,000 to 45,000 | EUR 8,000 to 12,000 |
| Managed SIEM option (external SOC) | In parallel | EUR 0 build | EUR 12,000 to 30,000 |
| DR option with secondary site | 1 extra month | EUR 6,000 to 12,000 | EUR 3,000 to 6,000 |
Recurring costs cover vulnerability monitoring, dependency updates, quarterly access reviews and an annual restore test. A maintenance contract without these deliverables is not enough to demonstrate compliance.
Regulatory deadlines to build into the application
NIS2 requires incident reporting in three steps: early warning within 24 h, notification within 72 h, final report within 1 month. The app must therefore produce evidence quickly: usable logs, timeline, affected scope. Without centralised logging, reconstructing an incident often takes more than 72 h, putting the company in breach from its very first incident.
Mini case study
Thomas, operations director of a 420-employee logistics company near Lille, runs a 7-year-old shipment tracking app used by 180 staff and 60 carriers. Diagnosis: no MFA for carriers, local logs deleted after 30 days, 14 dependencies with critical vulnerabilities.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Chosen plan: MFA and SSO (EUR 6,000), logging to a SIEM (EUR 7,500), dependency fixes (EUR 5,000), backups and restore test (EUR 5,500), access review (EUR 3,000), final pentest (EUR 7,000). Total: EUR 34,000 excl. VAT over 3 months, plus EUR 8,000 a year to maintain. With EUR 95M turnover, the theoretical maximum fine would be EUR 1.33M (1.4%). A single day of app downtime also costs about EUR 40,000 in carrier penalties and customer delays: the project pays back with the first avoided incident.
FAQ
How do I know whether my company is a NIS2 important entity?
The test combines sector (transport, logistics, manufacturing, digital services...) and size: from 50 employees or EUR 10M turnover. National authorities such as ANSSI provide an online self-assessment tool to confirm the status.
Is MFA mandatory for every user?
The directive lists multi-factor authentication among expected measures. In practice it is required on privileged and external accounts, often 30 to 40% of accounts; extending it to everyone rarely costs more than EUR 1,500 extra.
How long should logs be kept?
Twelve months is the recommended order of magnitude in 2026, with 6 months quickly searchable. Storage typically costs EUR 50 to 300 a month depending on volume.
Should we rebuild the app rather than upgrade it?
If the upgrade exceeds 60% of a rebuild's cost, rebuilding becomes preferable. For a shipment tracking app, a rebuild runs EUR 80,000 to 150,000 excl. VAT, so upgrading almost always remains more cost-effective.
Who is liable in case of non-compliance?
NIS2 makes management accountable: executives must approve the measures and take training. The development vendor must supply the technical evidence, hence the value of a contract listing security deliverables.
Let's scope your project. Send us your application's scope and technical state: we price the NIS2 upgrade work package by work package, with an indicative budget and a 2 to 4 month schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
