Applicability and scope context
Entity scope, services, sector context and the assumptions behind applicability are made explicit before gaps are rated.
NIS2 · Defined starting point
Put the highest exposures in the right order. NIS2 Gap Analysis.
A focused assessment of governance, cybersecurity measures, incident capability, supplier risk and evidence, translated into a prioritised management route.
20 minutes · no obligation · usually a reply within one business day
NIS2 · Gap Analysis
Discuss your NIS2 Gap Analysis →From € 1,995 excl. VAT
Report included. Final pricing follows a written scope agreement; complexity and requested depth may affect the project fee. Indicative turnaround: 2–4 working days for a defined scope, subject to timely access to documentation.
What you get
A prioritised view of NIS2 exposure.
The review connects applicability, governance, security measures, supplier dependencies and incident readiness in one management view.
Governance and accountability review
Board accountability, roles, reporting and risk ownership are reviewed alongside operational responsibilities.
Security-measure gap view
Existing security measures are mapped against the relevant NIS2 outcomes to identify material weaknesses and evidence gaps.
Supplier and incident readiness
Critical suppliers, incident escalation and reporting readiness are reviewed as part of the same control model.
Prioritised action plan
Management receives a prioritised action plan that separates urgent exposure from longer-term maturity work.
How it works
From applicability to an action order management can own.
The review moves from scope to governance, measures, dependencies and a clear sequence of action.
Frame
Confirm the organisational and regulatory context.
Assess
Review current governance, measures, ownership and evidence.
Prioritise
Focus on material control gaps and critical dependencies.
Decide
Give management a clear implementation and governance agenda.
Fit check
Use this when you need to know where NIS2 creates real exposure.
A good fit when NIS2 applies or is commercially expected and you need a practical baseline rather than another generic checklist.
Discuss your situationBack to NIS2 →Defined scopeThe work is bounded before it starts.
Senior-ledOne senior line through assessment and decision.
No forced follow-onThe output remains useful without a mandatory next engagement.
BEFORE YOU DECIDE
Defined scope: what is reviewed and delivered
The starting assessment is designed to clarify NIS2-related exposure and management priorities, with a documented scope and a report included in the agreed price. It does not replace a formal legal opinion.
Included in a typical base scope
One defined organisation or business unit, a focused applicability discussion, review of agreed core records, interviews with selected key roles, governance and cybersecurity measure assessment, and a management summary with a prioritised improvement route.
What the report makes visible
Assumptions about applicability, board and operational responsibilities, evidence gaps, incident readiness, critical supplier dependencies and the actions that deserve earliest management attention.
Activities agreed separately
Comprehensive legal advice, full implementation, extensive testing of every technical safeguard, multi-entity reviews and broader supplier audits are scoped as separate work where needed.
Questions to settle before commissioning
Is the gap analysis a legal determination of our NIS2 status?
No. It makes assumptions and open questions explicit. Specialist legal or supervisory guidance may be needed for a binding interpretation.
Does the starting fee include reporting?
Yes, for the documented base scope. Timing, complexity and additional locations or systems are considered before the final written offer.
A practical first step
Put the highest NIS2 exposures in the right order.
Tell us what you already know about applicability, current controls and supplier dependencies. We will help define the most useful assessment scope.
Discuss your NIS2 Gap Analysis