Ahead through knowledge and experience
More topics:ISO 27001ISO 27701TISAXNIS-2CADISISO 22301OT-SecurityCRADefence
DEENESFR
NIS2
NIS2 has applied in Germany since 6 December 2025: check in 2 minutes whether you are affectedBSI registration deadline expired on 31 July 2026: not registered yet? We help immediatelyManagement is personally liable and must be trained (§ 38 BSIG)Reporting duty: early warning within 24 hours, notification within 72 hours, final report after one month (§ 32 BSIG)Fines up to €10 million or 2% of worldwide turnover (§ 65 BSIG)CONSUVATION: the NIS2 solution built on knowledge, experience and a platform
GRC Platform › International
International

ISO 27001, TISAX and NIS2 in Europe and the US

← Back to the GRC platform

Many of our clients have sites outside Germany or supply customers abroad. We consult and audit wherever your sites are, with one management system for all countries.

ISO/IEC 27001 in Europe and the US

  • One ISMS for several countries as a multi-site certification
  • ISO 27001 as the recommended baseline, extended by country-specific IT security standards such as BSI IT-Grundschutz. This matters for national NIS2 implementation.
  • Country-specific requirements integrated: NIS2 implementation laws, GDPR and national data protection laws, Swiss nDSG (FADP)
  • Documentation in German, English and other languages
  • On-site consulting and audits at your sites in Europe and the US
GermanyAustriaSwitzerlandFranceSpainother EU countriesUSA

TISAX in Europe and the US

  • Suppliers with sites in Europe and US companies that supply European OEMs
  • TISAX consulting and TISAX assessors for sites in Europe and the US
  • Assessments and documentation in German, English and other languages based on VDA ISA
  • Adding further sites in Europe and the US to the scope of an existing label
  • Alignment with ISO 27001 and US state-level data protection requirements
EuropeUSAVDA ISAENX label

NIS2 in every EU country and for companies outside the EU

  • Multiple sites in Europe: Each establishment is subject to the NIS2 law of its country, with its own registration, authority and reporting channels. We implement NIS2 in every EU country, steered through one management system.
  • Digital services such as cloud, data centres, managed services or online marketplaces: the country of the main establishment in the EU is responsible.
  • Providers without an EU establishment that offer such services in the EU must designate a representative in the EU. Without one, any EU country in which they operate can take action (Art. 26 NIS2).
  • Suppliers outside Europe, for example from the US: without an EU establishment usually not directly in scope. Their European customers must, however, secure their supply chain and pass NIS2 requirements on by contract. We make you able to provide evidence.
  • Manufacturers of connected products: products on the EU market are also subject to the Cyber Resilience Act, with reporting obligations since 11 September 2026.
All EU countriesUSAThird countriesArt. 26 NIS2

International legal monitoring

New laws, implementation acts and regulatory guidance no longer reach you by chance. We monitor the legal situation in your countries and assess what changes for you.

  • Legal register per country with legal basis, obligations, deadlines and competent authority
  • Documentation maps for all management systems, internationally for Europe and the US
  • Topics: information security, data protection, AI, product cybersecurity and supply chain
  • Relevance assessment and derived measures directly in the platform
  • Deadline overview and regular reports to senior management
EUGermanyAustriaSwitzerlandFranceSpainUSA
← Back to the GRC platform

See the platform in 30 minutes

We show you the platform using your target standard as the example and discuss the shortest route to certification for you.

Request a demo by email+49 (0) 7031.4181-860
contact@consuvation.com
CONSUVATION GmbH · Tilsiter Str. 6 · D-71065 Sindelfingen · +49 (0) 7031.4181-860 · contact@consuvation.com