Mandatory for essential and important entities under NIS2
Article 21(2)(a) NIS2 requires essential and important entities to analyse the risks to their network and information systems and derive proportionate measures.
Risk analysis is the first of the ten minimum measures in Article 21(2) NIS2 and the basis for all others: it determines which measures are proportionate. Entities must identify threats and vulnerabilities to their network and information systems, assess likelihood and impact, review the effectiveness of existing controls and document the results. The method is free to choose; recognised options include ISO/IEC 27005 and BSI Standard 200-3.
The assessment follows an all-hazards approach, covering fire, power outages and human error as well, and must be updated regularly and after significant changes or incidents.
We run the NIS2 risk assessment together with IT, business units and information security: define the scope, inventory assets and supplier dependencies, assess risks, set acceptance criteria and risk owners, and produce a treatment plan for management approval. Where an ISO 27001 ISMS exists, we build on its risk assessment instead of introducing a second method.
2 service modules
We define scope and method, inventory assets and their protection needs, assess threats and vulnerabilities and document the results so that they stand up to supervisory review.
We turn the assessment into a treatment plan (avoid, reduce, transfer, accept), agree it with management and set up regular and event-driven reviews, for example after incidents or when suppliers change.
5 phases
We carry out the risk assessment in six steps and embed it so that your team can keep it current.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
Effective risk analysis systems transform complex threat landscapes into strategic intelligence. Our systematic approach ensures not only NIS2 compliance but creates sustainable competitive advantage through superior risk intelligence.
Without a risk assessment you cannot justify which measures are proportionate. That is why the risk assessment comes before implementing the other Article 21 measures.
6 QUESTIONS, BRIEFLY ANSWERED
NIS2 Article 21(2)(a) requires policies for risk analysis and information system security. Entities must: systematically identify all relevant threats and vulnerabilities to their network and information systems, assess the likelihood and impact of each risk, create and implement risk treatment plans, document findings, and present results to the management body.
NIS2 risk analysis must cover all network and information systems relevant to delivering essential services: IT infrastructure (servers, network components, cloud services), OT systems (production and control systems), critical software applications, communication systems, and external systems of suppliers and service providers that are accessed. Scope definition is the first critical step.
Steps for a NIS2-compliant risk analysis: (1) define scope, (2) inventory and classify assets, (3) identify threats and vulnerabilities, (4) assess risks (likelihood x impact), (5) plan risk treatment (mitigate, accept, transfer), (6) implement measures, (7) document risks and measures, (8) present results to management for approval. Recognized methods: ISO 27001, BSI-Standard 200‑3, OCTAVE.
NIS2 does not prescribe a fixed frequency, but requires regular review, in particular when the threat landscape changes or new vulnerabilities become known. Other triggers are significant changes to systems or processes, security incidents and new or changed suppliers. ISO 27001 requires risk assessments at planned intervals and when significant changes occur. In practice, an annual cycle is a sensible minimum.
ISO 27001 and NIS2 both require a systematic risk assessment. In ISO 27001 it sits in clauses 6.1.2 and 8.2 (risk assessment) and 6.1.3 and 8.3 (risk treatment); Annex A is the list of controls. NIS2 is legally binding and focuses the assessment on the services of the entity. An ISO 27001-compliant risk assessment generally meets Article 21(2)(a) if its scope covers all relevant systems. Conversely, NIS2 compliance alone is not sufficient for ISO 27001 certification.
NIS2 requires documentation of risk analysis as evidence for supervisory authorities. Minimum contents: methodology description, asset inventory with classification, identified threats and vulnerabilities, risk assessment matrix, risk treatment decisions, action plan with owners and deadlines, management body approval, and date of last update. Documentation must be current and complete for NIS2 audits.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance