NIS2 Gap Analysis

A NIS 2 gap analysis is a structured assessment that compares your organization's current cybersecurity maturity against the NIS 2 Directive requirements (especially Art. 21). The output is a clear picture of all compliance gaps, prioritized by risk and implementation effort. The gap analysis is the essential first step before any NIS 2 implementation. Without knowing your current state, no meaningful roadmap can be built.

A professional NIS 2 gap analysis follows five steps: 1) Scoping (which systems, locations and processes are in scope?), 2) Document review (existing policies, ISMS documentation, protocols), 3) Interviews & technical assessment (conversations with IT, management and business units, system reviews), 4) Gap evaluation (traffic-light rating per area: red/yellow/green with risk classification), 5) Reporting & roadmap (prioritized action plan with quick wins and medium-term measures).

A complete NIS 2 gap analysis reviews all ten Art.

21 security domains: risk analysis and security policies, incident handling, business continuity, supply chain security, secure development/procurement, effectiveness measurement, cyber hygiene/training, cryptography, personnel security, and MFA/authentication. Additionally, governance (Art. 20), BSI registration obligations and sector-specific requirements are assessed.

Duration depends on the size and complexity of the organization: medium-sized entities (50–250 employees) typically 2–4 weeks; larger enterprises with complex IT landscapes 6–8 weeks. A typical breakdown:

1 week preparation and document review, 1–2 weeks technical assessment and interviews,

1 week analysis and reporting. Remote-based assessments can slightly compress the timeline.

The gap analysis is an internal or consulting-based assessment without formal certification. It serves preparation and roadmap development. A NIS 2 audit is a formal examination by accredited bodies or authorities (BSI for essential entities in Germany) that attests actual compliance. Best practice: conduct the gap analysis first to close gaps, then pursue the audit as evidence for supervisory authorities.

Costs vary significantly by scope and entity size: SMEs with manageable IT landscapes: from approximately €15,000–30,000. Medium-sized entities: €30,000–80,000. Large essential entities with complex infrastructure: €80,000–200,

000 and above. Compared to potential NIS 2 fines (up to EUR

10 million or 2% of global annual revenue), a professional gap analysis is a clear investment in risk avoidance.