SecScope

NIS2 and CRA Implementation Effort Calculator

Controls are half the work. Evidence is the other half, and the half nobody budgets for.

Systems / products in scope

Controls required per system

Hours to implement one control

Evidence artefacts per control

Hours per evidence artefact

Internal hourly rate ($)

External advisory / legal ($)

Contingency (%)

Total programme cost

$238,750

This estimates engineering effort and budget only. It does not determine whether you are in scope, which obligations apply, or whether you would pass an assessment — those are legal determinations requiring qualified review.

Engineering effort: 2,250 hr
Evidence share of effort: 50%
Control instances: 150

What you entered

Systems / products in scope: 6Controls required per system: 25Hours to implement one control: 6Evidence artefacts per control: 2Hours per evidence artefact: 3Internal hourly rate ($): 95External advisory / legal ($): 25000Contingency (%): 25

1
Control instances to satisfy
6 systems × 25 controls= 150 instances
2
Implementation effort
150 × 6 hr= 900 hr
3
Evidence effort
150 × 2 artefacts × 3 hr= 900 hr (50% of effort)
4
Add 25% contingency
1,800 hr × 1.25= 2,250 hr
5
Cost including external advisory
2,250 hr × $95 + $25,000= $238,750

Result

Total programme cost: $238,750

Satisfying 150 control instances takes roughly 2,250 hr and $238,750 including advisory. Evidence work is 50% of that — the half teams routinely leave out of the estimate. This is an effort projection, not a compliance opinion.

NIS2 and CRA implementation effort and cost by programme size

Each row multiplies systems in scope by controls per system to get control instances, then prices 6 hours to implement each one and 2 evidence artefacts at 3 hours each. A 25 percent contingency is applied to the combined effort, costed at 95 dollars an hour internally, and 25,000 dollars of external advisory and legal is added on top.

Systems in scope	Controls per system	Control instances	Total effort (hr, incl. contingency)	Total programme cost
1	15	15	225	$46,375
2	20	40	600	$82,000
3	25	75	1,125	$131,875
6	25	150	2,250	$238,750
10	30	300	4,500	$452,500
15	35	525	7,875	$773,125
25	40	1,000	15,000	$1,450,000

Under these assumptions evidence work is exactly 50 percent of the effort in every row, because 2 artefacts at 3 hours matches the 6 hours of implementation per control instance. That parity is the point: teams estimate the engineering, forget the policies, diagrams, test records and review minutes, and land at roughly half the real number. Internal effort scales linearly with control instances while the 25,000 dollar advisory line is flat, so advisory is 2 percent of a 25-system programme and 54 percent of a single-product one. This prices effort under assumptions you supply. It does not determine whether NIS2 or the Cyber Resilience Act applies to you, which controls are in scope, or whether you would pass an assessment - those are legal determinations that need qualified counsel. Illustrative only; run your own numbers with your own control list and internal rate.

A security compliance effort calculator estimates what it costs to implement a regulation such as NIS2 or the Cyber Resilience Act, in engineering hours and money. Both regimes impose security obligations on organisations and products rather than prescribing a single certificate to buy, so the cost lands as internal work spread across teams, which makes it easy to underestimate until the programme is already underway.

The model builds from control instances rather than controls. A control applied across six systems is six pieces of work, not one, because each system needs its own configuration, testing and sign-off. Multiplying systems in scope by controls required gives the real unit of work. Implementation hours cover actually building or changing each control. Evidence hours cover the artefacts each control needs, such as policies, diagrams, test records, logs and review minutes, priced as artefacts per control multiplied by hours per artefact. A contingency percentage is applied on top, then the total is costed at an internal rate and added to external advisory and legal fees.

Separating evidence from implementation is the point. Teams estimate the engineering and forget the paperwork, yet on most programmes the evidence half is comparable to or larger than the implementation half, because a control that works but cannot be demonstrated counts for nothing in an assessment. Surfacing that split as a percentage usually reframes the plan: it argues for generating evidence automatically from systems that already produce it, rather than assembling it by hand at the end.

Two limits matter. This estimates effort and budget; it does not determine whether you are in scope, which obligations apply to your products, or whether you would pass an assessment. Those are legal determinations that depend on your sector, size and role in the supply chain, and they require qualified review. Control counts also vary enormously by interpretation, and a conservative reading can double the scope. Use this to size a programme and argue for resourcing, then let counsel and a qualified assessor set the actual scope.

Count control instances, not controls

A control applied across six systems is six pieces of work: each needs its own configuration, testing and sign-off. Estimating from the control list alone, rather than controls multiplied by systems, is the most common way these programmes come in at a fraction of their real size.

Evidence is comparable to implementation

A control that works but cannot be demonstrated counts for nothing in an assessment. Policies, diagrams, test records and review minutes often add up to as much effort as the engineering itself, which is the argument for generating evidence automatically from systems that already emit it rather than assembling it by hand at the end.

Frequently asked questions

6 systems, 25 controls each, 6 hours to implement and 2 artefacts at 3 hours - what is the effort?

That is 150 control instances: 900 hours of implementation plus 900 hours of evidence, so evidence is 50% of the work. With 25% contingency the total is 2,250 hours, about $213,750 internally, plus $25,000 advisory, giving roughly $238,750.

Does this tell me whether NIS2 or the CRA applies to me?

No. Scope depends on your sector, size and role in the supply chain, and it is a legal determination. This calculator prices the effort once you know you are in scope and have a control list. Confirm applicability with qualified counsel.

Why is evidence effort so large?

Because assessments test what you can demonstrate, not what you believe is true. Each control typically needs policies, architecture evidence, test records and periodic review artefacts. Teams estimate the engineering and discover the documentation only when an assessor asks for it.

How is this different from the SOC 2 calculator?

This prices implementing a regulation's controls across systems, where the obligation is ongoing and there is no certificate to buy. The SOC 2 and ISO 27001 calculator prices a certification lifecycle: readiness, an auditor fee, and recurring surveillance audits.