NIS2 Readiness Assessment

An NIS2 readiness assessment is a structured analysis comparing your organization's current cybersecurity maturity against NIS2 Directive requirements. It evaluates all ten security domains from Article 21, assesses governance structures under Article 20, and identifies concrete compliance gaps. The output is a prioritized action plan for efficient NIS2 preparation.

A comprehensive NIS2 readiness assessment covers: risk analysis and security policies, incident handling and notification processes, business continuity management, supply chain security, technical security measures including MFA, cryptography, and patch management, governance and management accountability under Art. 20, and registration obligations with competent authorities. All areas are benchmarked against NIS2 standards.

Your NIS2 readiness depends on how well your existing cybersecurity measures already meet NIS2 requirements. Organizations with ISO 27001 certification or an established ISMS typically achieve 50‑70% readiness. Common gaps include supply chain security, incident notification processes with 24h and 72h deadlines, and management training obligations under Art. 20. A gap assessment provides an accurate picture of your specific readiness level.

The most common NIS2 readiness gaps are: missing or incomplete risk analyses per Art. 21, no documented incident response processes with required notification timelines of 24h initial and 72h follow-up, insufficient supply chain security including vendor contracts and assessments, missing management training per Art. 20, inadequate multi-factor authentication, and absent business continuity plans. According to ENISA, over 60% of in-scope entities are not yet fully compliant.

Financial entities subject to both NIS2 and DORA must address both frameworks. DORA acts as lex specialis for the financial sector and takes precedence. In practice, DORA compliance covers many NIS2 requirements but not all. An NIS2 readiness assessment for financial entities explicitly maps DORA overlaps and identifies remaining NIS2-specific gaps to avoid duplication of effort.

A professional NIS2 readiness assessment takes 2‑8 weeks depending on organization size: SMEs with simple IT take approx. 2‑3 weeks; medium-sized entities need 3‑5 weeks; large essential entities with complex infrastructure require 6‑8 weeks. Costs range from approx. 15,000‑30,000 EUR for SMEs, 30,000‑80,000 EUR for medium entities, and 80,000‑200,000 EUR or more for large essential entities. Compared to potential NIS2 fines of up to 10 million EUR or 2% of global annual turnover, a readiness assessment is a sound risk mitigation investment.