Pricing
Start free. Pay only for what adds value.
The core is free forever. Premium adds automation and verification, with AI analysis included, and consulting puts a specialist at your side. What has a fixed scope has a published price; the rest is quoted in writing, before you decide.
Open-source core
on-premises · AGPL-3.0 licence · no per-user cost
The complete gap-analysis platform, deployed on your infrastructure via Docker.
- Guided diagnosis and action plan
- All 107 QNRCS controls, with implementation guides
- Evidence, incidents, recurring tasks and training records
- 14 document templates and management reports
- Five roles, mandatory 2FA and a tamper-evident audit log
- On-premises: your data stays 100% under your control
Premium
launch price for the first year, for requests until 30 November · then €1,990/year
on-premises licence · per organisation, no per-user cost
Everything in the core, plus:
- Asset inventory, with dependencies and criticality
- Risk analysis with over 30 ready-to-use scenarios
- Suppliers: due diligence and risk assessment
- Import from GLPI, Monarc, OpenVAS and Wazuh, with cross-checking
- Technical checks on Microsoft 365 and Active Directory
- AI analysis of documentation and evidence
Consulting
fixed written proposal, service by service · longer engagements are quoted according to the compliance level and the scope
Specialised remote advisory, by the person who built the platform.
- NIS2 diagnosis · €2,900
- Guided implementation · on request
- Supervision readiness · on request
- On-premises Premium licence included during the engagement
VAT not included. Premium is an annual licence at a fixed price; consulting and training prices are "from" values and are fixed in a written proposal, with scope and timeline. The initial 30-minute call is free and commits you to nothing.
Training
Cyber hygiene and risk management
Three courses shaped around who receives them, remote and in a closed group. The participation record can be attached in the platform as evidence of the QNRCS training control.
Cyber hygiene and risk for management
from €950 · 3 hours
Cybersecurity risk as a matter of decision, not a technical subject.
Cyber hygiene and risk management for technical teams
from €1,800 · 7 hours
The practices that stop most incidents, and the evidence the law requires.
Cyber hygiene for employees
from €650 · 2 hours
Two hours that change the behaviour of whoever sits at the computer.
All three together, from €2,800, instead of €3,400. VAT not included, priced per session and not per participant. Each session takes up to 10 participants, 20 for the employee training.
Frequently asked questions
About pricing and plans
What exactly does the free core include?
Everything in the public repository: guided diagnosis and action plan, all 107 QNRCS controls with implementation guides, evidence, incidents, recurring tasks, training records, 14 document templates, reports and multi-user support with an audit log. It deploys with Docker and is free forever, under the AGPL-3.0 licence.
How do I try Premium?
The 14-day evaluation trial includes the core and AI analysis, no credit card required. The other Premium modules (inventory, risk, suppliers, import and technical checks) are shown in a 30-minute live demo, with sample data. To book one, just talk to NIS2PME.
Where is evaluation trial data hosted?
On servers in the European Union, from a European provider. The trial is meant for demo data: the account is suspended at the end of the period and deleted 5 days later. For real work, both the core and Premium are deployed on your own infrastructure and the data stays there. The only exception is Premium's AI analysis: the evidence for the control you send for analysis is sent encrypted to the NIS2PME AI service, hosted in Europe, which does not keep it.
How is the Premium licence activated?
Once you accept the proposal, you send your installation code, shown by the platform in the System area. You receive the licence by email and install it in the platform itself.
What if I do not renew Premium?
The data in the Premium modules becomes read-only, with no time limit, and you can always export it. The core keeps working as before.
Why are some figures on request?
What has a fixed scope is published; what does not is quoted. Premium is the same licence for everyone, and the diagnosis has a defined scope: both have a price here. Guided implementation and supervision readiness, on the other hand, depend on the applicable compliance level and on the maturity the company already has. A "from" price in those cases would anchor low only to be corrected in the proposal, and that costs more trust than saying plainly that it is quoted case by case.
Does the training come with a certificate?
NIS2PME issues a participation certificate, which serves as a training record for evidence purposes. That is exactly what Decree-Law 125/2025 and the QNRCS ask for. It is not training certified by DGERT, nor eligible for the Portuguese Cheque-Formação scheme.
How do I know what I will pay before deciding?
Every project starts with a free, no-commitment call to establish the scope. You then receive a written proposal with a fixed scope, timeline and price. You only decide once you have the figure in front of you, and the agreed price does not change mid-engagement.
What if the QNRCS is updated?
The platform follows CNCS updates and guidance and reflects them, preserving your answers and progress. That is a public commitment of the project.
Still unsure which plan fits?
Try the evaluation trial or book a call: in 30 minutes you will know which path makes sense for your company.