Comparison Against the Ten Article 21 Measures
A NIS2 gap analysis compares your security measures point by point with the ten minimum measures of Article 21(2) and shows where evidence is missing, where measures only partly work and what to do first.
Article 21 NIS2 requires essential and important entities to take appropriate and proportionate measures, with at least ten minimum measures listed in Article 21(2). A NIS2 gap analysis checks each of them, plus incident reporting (Article 23), management accountability and training (Article 20) and, in Germany, registration and the duty to document compliance under the BSIG.
For cloud, data centre, managed service and other digital providers, Implementing Regulation (EU) 2024/2690 adds detailed technical requirements.
We derive a test catalogue from Article 21, review policies, procedures and evidence, interview IT, business units and management, and sample selected technical settings. Existing ISO/IEC 27001 or IT-Grundschutz work is credited. Each measure gets a maturity rating with reasons, and gaps are prioritised by legal obligation, risk and effort. If applicability is still open, start with the NIS2 Scope Assessment; the phase plan afterwards is our NIS2 Compliance Roadmap.
2 service modules
We check each of the ten minimum measures plus reporting, registration and management duties, and rate maturity based on documents, interviews and samples.
We summarise the results in a gap report with a maturity rating per measure and prioritise the gaps so you know what to do first.
5 phases
We run the NIS2 gap analysis in five steps, from scope to the management presentation.
companies, services and sites
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
A professional gap analysis is the key to efficient NIS2 implementation. Our structured approach not only identifies compliance gaps but also creates the foundation for strategic cybersecurity investments.
The German BSIG requires entities to document compliance with the measures (Section 30(1)), and failing to do so can be fined. A measure that is practised but not evidenced therefore counts as a gap in our analysis.
8 QUESTIONS, BRIEFLY ANSWERED
A NIS2 gap analysis is a structured assessment that compares your organization's current cybersecurity maturity against the NIS2 Directive requirements (especially Art. 21). The output is a clear picture of all compliance gaps, prioritized by risk and implementation effort. The gap analysis is the essential first step before any NIS2 implementation. Without knowing your current state, no meaningful roadmap can be built.
A professional NIS2 gap analysis follows five steps: 1) Scoping (which systems, locations and processes are in scope?), 2) Document review (existing policies, ISMS documentation, protocols), 3) Interviews & technical assessment (conversations with IT, management and business units, system reviews), 4) Gap evaluation (traffic-light rating per area: red/yellow/green with risk classification), 5) Reporting & roadmap (prioritized action plan with quick wins and medium-term measures).
All ten minimum measures of Article 21(2): risk analysis and information security policies, incident handling, business continuity with backup, disaster recovery and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling, assessment of effectiveness, cyber hygiene and training, cryptography, human resources security, access control and asset management, and multi-factor authentication with secured communications. We also assess documentation, reporting, registration, management training and, where relevant, Implementing Regulation (EU) 2024/2690.
The number of companies, services and sites in scope, the existing foundation (such as ISO/IEC 27001 or IT-Grundschutz), the extent and quality of documentation, and the availability of interviewees. The usual sequence is preparation and document review, interviews and sampling, then analysis and reporting. We agree the timeline in the initial call.
The gap analysis is an internal or consultant-supported assessment without a formal requirement; it serves preparation. An audit is a formal examination by an independent body. There is no NIS2 certificate as such, but supervisors can order audits for essential entities; in Germany the BSI can require audits, inspections or certifications by independent bodies (Section 61 BSIG), and operators of critical facilities must provide evidence every three years (Section 39 BSIG). Sensible order: find and close gaps first, then get audited.
Effort depends on scope, on whether you want a document review only or also technical sampling, on the format (on site or remote) and on how much is already evidenced. An existing ISMS reduces effort considerably because we credit existing evidence. We give you a binding frame after the initial call.
Yes, with a test catalogue derived from Article 21 and an honest rating a self-assessment is possible; free templates and checklists help. The limits are independence, judging whether a measure is effective and evidenced, and interpreting evidence. Many organisations therefore combine internal preparation with an external review.
Only partly. ISO/IEC 27001 covers many measures but not NIS2-specific duties such as reporting deadlines, management training and, in Germany, registration. The ISMS scope must also cover all services that fall under NIS2. A NIS2 gap analysis can use an existing ISO assessment as its starting point and add what is missing.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance