Denmark · Compliance
NIS2 compliance in Denmark
Achieve NIS2 compliance in Denmark with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for NIS2 in Denmark
Clients include
NIS2 compliance in Denmark at a glance
Lov nr. 434 af 6. maj 2025: Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Denmark ask for evidence that you meet it.
Few European countries spread NIS2 supervision as widely as Denmark. The NIS 2-loven, Lov nr. 434 of 6 May 2025, has applied since 1 July 2025, but oversight is split between the Styrelsen for Samfundssikkerhed and sector authorities named in a designation order, from Energistyrelsen and Trafikstyrelsen to Digitaliseringsstyrelsen and Finanstilsynet. Entities register on virk.dk, and financial entities under DORA are outside that duty. There is no NIS2 certificate. SAMSIK's measure guidance maps each duty to standards such as ISO/IEC 27001 and says that using one does not itself prove compliance, so the work is applicability, governance, risk measures and evidence. Sterling's Enschede office runs the applicability check, gap analysis and documentation, with Effivity and Sterling Academy included with the engagement.
Who needs NIS2 in Denmark, and what happens without it
These are the organisations in Denmark that most often need to show NIS2.
- Essential and important entities in listed sectorsThe NIS 2-loven applies to entities in the sectors in its annexes that meet the size or special-importance tests, and SAMSIK offers the NIS2tjek tool to test applicability.
- Municipalities and state authoritiesSAMSIK is the competent authority for these bodies and began a survey-based supervision of municipalities in 2026.
- Manufacturers of electronics, machinery, vehicles and chemicalsSAMSIK is sector authority for these parts of manufacturing, so Danish industrial groups fall under its supervision.
- Digital providers, cloud and data centre operatorsDigitaliseringsstyrelsen is the sector authority for cloud, data centre, DNS and similar providers.
- Financial entitiesDORA applies to them directly, and SAMSIK says the registration duty does not concern DORA entities.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkNIS2 requirements in Denmark
Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.
In Denmark these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →
How to achieve NIS2 compliance in Denmark
One team from the Enschede office carries the work from scoping to sign-off. Clients in Denmark are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against NIS2 and the Danish requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does NIS2 compliance take in Denmark?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Denmark these are the factors that set the timeline.
- Whether the entity is essential or important and which sector authority applies
- Existing information security management system and incident reporting arrangements
- Management training and board reporting
- Supply-chain and cloud dependencies
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does NIS2 compliance cost in Denmark?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Denmark these factors move both.
- Number of legal entities and sectors in scope
- Control remediation across the group
- Optional certification body fees for ISO/IEC 27001
- Overlap with DORA for financial groups
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
NIS2 consultants and assessors in Denmark
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Denmark are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive NIS2 in Denmark (5)
| Instrument | How it treats the standard |
|---|---|
| Lov nr. 434 af 6. maj 2025: Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven) | The instrument itself It implements Directive (EU) 2022/2555; the Styrelsen for Samfundssikkerhed (SAMSIK) states that Folketinget passed it on 29 April 2025 and that it entered into force on 1 July 2025. |
| Executive Order on the designation of competent authorities and digital communication under the NIS 2 Law (BEK nr. 620 af 2. juni 2025) | Implementing order SAMSIK says supervision sits with sector authorities listed under it, for example Finanstilsynet for financial digital infrastructure, Digitaliseringsstyrelsen for digital providers, Energistyrelsen for energy and Fødevarestyrelsen for wholesale and industrial food. |
| NIS 2 registration with the sector authorities (virk.dk) | Regulator guidance SAMSIK says entities register through a digital form on virk.dk with MitID Erhverv, the form is routed to the relevant sector authorities, and entities covered by DORA do not register. |
| SAMSIK guidance on implementing the cybersecurity measures of the NIS 2 Law | Regulator guidance Each chapter maps the measures to sections of DS/EN ISO/IEC 27001:2023, NIST CSF 2.0, IEC 62443 and other standards, and says that following a standard helps compliance but is not in itself assurance that the requirements are met. |
| Regulation (EU) 2022/2554 (DORA), supervised in Denmark by Finanstilsynet | The regulation itself Finanstilsynet says it applies directly to covered financial entities from 17 January 2025 and covers ICT risk management, incident reporting, resilience testing and ICT third-party risk. |
Accreditation, audit language and remote audits in Denmark
Compliance, not certification: there is no NIS2 certificate. Entities register, apply the measures and answer to their sector authority. ISO/IEC 27001 certification by a body accredited by DANAK can support the evidence, but SAMSIK's guidance says following a standard does not by itself prove compliance. Edition and transition details: NIS2 hub →
Audit language
Authorities publish in Danish with an English summary on SAMSIK's site. Internal documentation can be in Danish or English.
Remote and on-site
Applicability checks, gap assessments and policy work can be remote or on-site; supervision follows each sector authority's procedure.
NIS2 in Denmark: questions clients ask
Is the NIS2 law in force in Denmark?
Yes. SAMSIK states that Folketinget passed the NIS 2-loven on 29 April 2025 and that it entered into force on 1 July 2025. The act is Lov nr. 434 of 6 May 2025. SAMSIK gives 1 October 2025 as the date for covered entities to register on virk.dk. Your sector authority or counsel can confirm your own position.
Who supervises NIS2 compliance in Denmark?
The sector authority named in the designation order, not a single regulator. SAMSIK covers state bodies, municipalities, parts of manufacturing and chemicals; Finanstilsynet, Digitaliseringsstyrelsen, Energistyrelsen, Trafikstyrelsen, Sundhedsdatastyrelsen, Fødevarestyrelsen and others cover their sectors. Forsvarets Efterretningstjeneste acts as national CSIRT for incident reports. Check which authority holds your sector.
How do we register under the Danish NIS 2 law?
Through a digital form on virk.dk, using MitID Erhverv. SAMSIK says the form asks for the entity name, sector and sub-sector, contact details and the EU countries it operates in, then routes the submission to the relevant sector authorities. Entities covered by DORA are outside the registration duty. Read the form's guidance or ask your counsel if you are unsure.
Can ISO/IEC 27001 demonstrate NIS2 compliance in Denmark?
It helps but does not settle the question. SAMSIK's measures guide maps each duty to sections of DS/EN ISO/IEC 27001:2023, NIST CSF 2.0 and other standards, and states plainly that following a standard is not in itself assurance that the requirements are met. The sector authority judges compliance, so keep evidence of how each measure is applied.
More on NIS2 for Danish organisations
Other standards Danish businesses ask Sterling for
Organisations in Denmark often combine NIS2 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Lov nr. 434 af 6. maj 2025: Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau (NIS 2-loven) — samsik.dk (accessed 11 Oct 2026)
- Executive Order on the designation of competent authorities and digital communication under the NIS 2 Law (BEK nr. 620 af 2. juni 2025) — samsik.dk (accessed 11 Oct 2026)
- NIS 2 registration with the sector authorities (virk.dk) — samsik.dk (accessed 11 Oct 2026)
- SAMSIK guidance on implementing the cybersecurity measures of the NIS 2 Law — samsik.dk (accessed 11 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), supervised in Denmark by Finanstilsynet — finanstilsynet.dk (accessed 11 Oct 2026)
- DANAK (Den Danske Akkrediteringsfond, the Danish Accreditation Fund) — danak.dk; european-accreditation.org; ilac.org (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice