NIS2 Readiness Assessment

NIS2 Readiness Assessment — Your Current Posture Scored and Mapped

A comprehensive readiness assessment across all 10 NIS2 Article 21 measures — producing a quantified readiness score, a gap-by-gap remediation plan, and a realistic timeline to compliance based on your current starting point.

• 100-Point Readiness Score: Quantified assessment of your NIS2 readiness — comparable over time and across frameworks
• 10-Measure Breakdown: Individual score for each Article 21 measure with specific evidence gaps identified
• Board Readiness (Art. 20): Is your management body meeting NIS2 governance requirements? Personal liability assessment
• Incident Response Readiness: Can you meet the 24-hour notification deadline? Process assessment with improvement plan
• Supply Chain Readiness: Art. 21(d) supply chain security — the most common critical gap across all assessments
• Remediation Roadmap: Prioritised actions with effort estimation — realistic timeline based on your resources
• Framework Credit: What you have already done for ISO 27001, Cyber Essentials, or DSPT that counts toward NIS2
• Budget Estimation: What NIS2 compliance will cost for your specific gap profile — no surprises

NIS2 Annex I Maturity Scoring (All 10 Measures)

This assessment scores your maturity across every NIS2 Annex I cybersecurity risk-management measure and produces a regulator-ready evidence pack:

• (a) Risk analysis + security policy — Maturity 0-5 score on risk methodology, register completeness, policy review cadence
• (c) Business continuity + crisis management — Maturity scoring on BCP existence, DR test cadence, RTO/RPO definition, crisis comms readiness
• (e) Network + system security — Maturity scoring on patch management, secure configuration baselines, vulnerability management cadence
• (g) Cyber hygiene + training — Maturity scoring on awareness programme, training completion rates, phishing simulation results
• (h) Cryptography + encryption — Maturity scoring on encryption standards, key management, TLS version compliance, at-rest encryption coverage
• (i) Human resources + access control — Maturity scoring on RBAC, joiner/mover/leaver process, access reviews, privileged access management
• (j) Multi-factor + emergency comms — Maturity scoring on MFA enforcement scope, crisis comm tree freshness, out-of-band contact register

Article 23 reporting readiness: 72-hour formal notification readiness assessment — can your team produce the formal report within the window with current data, templates, and contact lists? Includes a "dry run" exercise template that times your team's response on a tabletop scenario and identifies bottlenecks.