NIS2 Readiness Assessment: How Ready Is Your Organisation?

A NIS2 readiness assessment is a structured baseline that compares your current information security with the obligations of NIS2: classification, the ten minimum measures of Article 21(2), incident reporting under Article 23 and management accountability under Article 20. For German entities it uses the BSIG (Sections 28, 30, 32, 33 and 38). The result is a maturity rating per area and a prioritised action plan.

It covers the ten minimum measures of Article 21(2) NIS2: risk analysis and information security policies, incident handling, business continuity with backup management, disaster recovery and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling, assessment of effectiveness, cyber hygiene and training, cryptography, human resources security, access control and asset management, and multi-factor authentication with secured communications. It also covers documentation, incident reporting, registration and management training.

It depends on how many of the ten measures are implemented and evidenced. An ISO/IEC 27001 ISMS covers many requirements but not the NIS2-specific duties such as registration, reporting significant incidents within the Article 23 deadlines and management training. It is also worth checking whether the ISMS scope covers all services that fall under NIS2. A reliable answer needs a rating per measure.

Common gaps are a documented risk analysis as the basis for measures, a tested reporting process for the Article 23 deadlines (early warning within 24 hours, incident notification within 72 hours, final report no later than one month after the notification), security requirements in supplier contracts, management training, multi-factor authentication for critical access and tested recovery plans. Often much is in place but not documented well enough to serve as evidence.

NIS2 gives way to sector-specific Union law with equivalent requirements (Article 4), and DORA is such an act for the financial sector. Germany makes this explicit: Sections 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply to financial entities within the meaning of Article 2(2) DORA (Section 28(6) BSIG). A readiness assessment therefore first checks whether this exemption applies and, in mixed groups, which companies remain subject to NIS2.

Mainly four factors: the number of companies, sites and services in scope, the existing foundation (for example an ISO/IEC 27001 ISMS or IT-Grundschutz), the quality of existing documentation, and the availability of your staff for interviews. We agree scope, format (on site or remote) and timeline in the initial call.

The gap analysis, often called a gap assessment, is part of the readiness assessment: it compares implemented measures with Article 21. The readiness assessment also covers scope and classification, registration, incident reporting and management duties, and ends with a prioritised plan. If you already know your classification and only need the comparison, the NIS2 Gap Analysis is the right service.

For a first orientation, free tools help, for example the BSI NIS-2-Betroffenheitsprüfung (German applicability check), the BSI #nis2know roadmap and checklist, and ENISA guidance. They do not assess your evidence: the BSI states that its check is not legally binding, and a checklist cannot tell whether a measure is effective and documented. An external assessment pays off for group structures, several business activities or when management needs an independent basis for decisions.

Article 34 NIS2 requires member states to provide maximum fines of at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and EUR 7 million or 1.4% for important entities. Germany implements this in Section 65 BSIG, where the percentage cap applies to entities with a total turnover above EUR 500 million. Supervisors can also order audits and remediation, and management can be held liable.