NIS2 Readiness Check

The NIS2 Directive (Directive (EU) 2022/2555) is the European Union's updated cybersecurity legislation, replacing the original NIS Directive from 2016. It establishes a high common level of cybersecurity across the Union by setting obligations for organizations in critical and important sectors.

NIS2 entered into force on 16 January 2023, and EU member states were required to transpose it into national law by 17 October 2024. The directive significantly expands the scope of the original NIS, covering more sectors, imposing stricter requirements, and introducing personal liability for management.

NIS2 covers 18 sectors (11 in Annex I and 7 in Annex II), many more than the original NIS Directive. If your organisation provides one of the services listed in the annexes in the EU and is medium-sized or larger under Commission Recommendation 2003/361/EC (in short: 50 or more employees, or annual turnover and balance sheet total both above €10 million), NIS2 very likely applies to you. Our scope guide walks through the rules.

NIS2 categorizes organizations into two groups with different oversight regimes:

Essential Entities (Stricter Supervision)

These organizations are subject to proactive regulatory supervision, including on-site inspections, regular audits, and the full range of enforcement powers. As a rule, essential entities are large organizations in the high-criticality sectors of Annex I: energy (electricity, oil, gas, hydrogen, district heating), transport (air, rail, water, road), banking and financial market infrastructures, health (hospitals, laboratories, pharmaceutical manufacturing), drinking water supply and distribution, wastewater management, digital infrastructure (DNS, TLD registries, cloud computing, data centres, CDNs, trust services), ICT service management in B2B contexts, public administration, and space. Medium-sized organizations in these sectors are generally important entities. Some entities are essential regardless of size, such as qualified trust service providers, TLD registries and DNS service providers.

Important Entities (Reactive Supervision)

These organizations face lighter, ex-post supervision — meaning authorities typically get involved only after an incident or evidence of non-compliance. Important entities also include medium-sized and large organizations in the other critical sectors of Annex II: postal and courier services, waste management, chemical manufacturing and distribution, food production and distribution, manufacturing (medical devices, computers, electronics, machinery, motor vehicles), digital providers (online marketplaces, search engines, social networking platforms), and research organizations.

Size Thresholds

Generally, NIS2 applies to organisations in covered sectors that are medium-sized or larger under Commission Recommendation 2003/361/EC (in short: 50 or more employees, or annual turnover and balance sheet total both above €10 million) (Article 2(1)). However, some entities are covered regardless of size: providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers. Member states can also bring smaller entities into scope, for example if they are the sole provider of an essential service. Cloud computing, data centre, CDN and managed security service providers are covered only from medium size upward.

NIS2 Article 21 establishes ten minimum cybersecurity risk management measures that covered entities must implement. Our assessment tool evaluates your readiness across these areas:

1. Risk Analysis and Information System Security Policies

Organizations must implement an ICT risk management framework that includes documented policies, regular risk assessments, and defined risk treatment approaches. This framework must be approved by the management body and reviewed regularly.

2. Incident Handling

NIS2 introduces strict incident reporting timelines. Organizations must submit an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours with an initial assessment, and a final report within one month including root cause analysis and remediation measures. These timelines are among the strictest in any EU regulation.

3. Business Continuity and Crisis Management

Covered entities must address business continuity, such as backup management and disaster recovery, and crisis management (Article 21(2)(c)). In practice this means plans for ICT-related disruptions that are tested and updated based on lessons learned.

4. Supply Chain Security

NIS2 places particular emphasis on supply chain risk. Organizations must assess and manage security risks arising from their relationships with direct suppliers and service providers. This includes contractual security requirements, ongoing supplier monitoring, and addressing concentration risk.

5. Security in Network and Information Systems

Article 21(2)(e) covers security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. Related measures sit elsewhere in Article 21(2): access control under point (i), cryptography and encryption under point (h), and multi-factor authentication under point (j). The measures must be proportionate to the risk.

6. Cybersecurity Training

Article 20(2) requires management body members to follow cybersecurity training, and encourages entities to offer similar training to their employees regularly. Article 21(2)(g) separately requires basic cyber hygiene practices and cybersecurity training as one of the risk-management measures.

7. Cryptography and Encryption

Covered entities must have policies and procedures for the use of cryptography and, where appropriate, encryption. This includes protecting data at rest and in transit with appropriate cryptographic standards.

One of the most significant changes NIS2 introduces is personal liability for management. Under Article 20, management bodies must approve cybersecurity risk management measures, oversee their implementation, and can be held liable for infringements.

For essential entities, competent authorities can impose temporary bans on management positions if individuals are found to have failed in their duties. This makes NIS2 compliance a board-level concern, not just an IT issue.

Management body members are also required to undergo cybersecurity training to maintain sufficient knowledge of cybersecurity risks and practices. This training must be relevant to the nature and complexity of the services and systems the organization operates.

NIS2 sets minimum levels for the maximum fines that national laws must allow (Article 34):

Essential entities: maximum fines of at least €10 million or 2% of total worldwide annual turnover, whichever is higher. They are also subject to proactive supervision, including on-site inspections and regular and targeted audits.

Important entities: maximum fines of at least €7 million or 1.4% of total worldwide annual turnover, whichever is higher. They face ex-post supervision: authorities act when they have evidence or an indication of non-compliance.

Beyond financial penalties, non-compliance can result in public disclosure of the violation, binding instructions from the competent authority, and for essential entities, temporary suspension of certifications and authorizations.

The check has two parts. First, three screening questions (sector, size and EU activity) give a first indication of whether NIS2 applies to you and whether you would be an essential or an important entity. Then 53 questions across 9 domains test the measures NIS2 requires: management accountability (Article 20), the cybersecurity risk-management measures of Article 21(2) and incident reporting (Article 23). The questions are our practical checks. Each maps to a legal measure, but not every check is itself a legal requirement (a 6-month log retention period, for example, is good practice rather than a rule in the directive).

All calculations happen in your browser. Your answers are not sent to any server, stored or tracked, and you can run the check as often as you like. The same questions are available to AI assistants through our MCP server (tool nis2_gap_assessment).

These are the questions the check asks, by domain, with the NIS2 article each domain is based on.

Governance & Accountability (NIS2 Art. 20, 6 questions)

• Has the management body formally approved a cybersecurity risk management strategy?
• Is there a designated person or team responsible for cybersecurity?
• Does the management body receive regular cybersecurity risk reports?
• Do management body members undergo cybersecurity awareness training?
• Is there a dedicated budget for cybersecurity, reviewed annually?
• Is there a designated NIS2 compliance point of contact?

Risk Management (NIS2 Art. 21(2)(a), 7 questions)

• Do you have a documented ICT risk management framework?
• Are risk assessments conducted at least annually?
• Is there a maintained inventory of critical assets and services?
• Are risk treatment plans documented with owners and timelines?
• Are third-party and supply chain risks included in your risk assessments?
• Is a risk register maintained and regularly updated?
• Are residual risks formally accepted by appropriate authority?

Incident Handling (NIS2 Art. 21(2)(b), Art. 23, 6 questions)

• Is there a documented and tested incident response plan?
• Do you have 24/7 incident detection capabilities for critical systems?
• Is there a defined incident classification and severity scheme?
• Can you submit an early warning to your CSIRT/authority within 24 hours?
• Can you submit an incident notification within 72 hours?
• Do you conduct post-incident reviews and capture lessons learned?

Business Continuity (NIS2 Art. 21(2)(c), 6 questions)

• Is there a business continuity plan covering essential services?
• Have you defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)?
• Are backups performed regularly for critical data and systems?
• Are backup restorations tested at least annually?
• Is there a documented disaster recovery plan?
• Are crisis management and communication procedures in place?

Supply Chain Security (NIS2 Art. 21(2)(d), 6 questions)

• Are critical suppliers and ICT service providers identified and inventoried?
• Are security requirements included in supplier contracts?
• Is supplier security posture assessed before onboarding?
• Do you conduct ongoing monitoring of supplier security?
• Are incident notification requirements agreed with suppliers?
• Do critical supplier contracts include right-to-audit clauses?

Network & Information Security (NIS2 Art. 21(2)(e), (i), (j), 6 questions)

• Is your network architecture documented with security zones and segmentation?
• Are firewalls and intrusion detection/prevention systems deployed?
• Is multi-factor authentication implemented for remote and privileged access?
• Is endpoint protection deployed on all devices?
• Are security logs retained for at least 6 months?
• Are secure configuration baselines defined and enforced?

Vulnerability Management (NIS2 Art. 21(2)(e), 6 questions)

• Is there a documented vulnerability management process?
• Are regular vulnerability scans performed on internal and external assets?
• Are critical vulnerabilities remediated within defined SLAs?
• Is there a patch management process covering all systems?
• Is penetration testing conducted at least annually?
• Do you have a coordinated vulnerability disclosure policy?

Cybersecurity Training (NIS2 Art. 20(2), Art. 21(2)(g), 5 questions)

• Is there a cybersecurity awareness program covering all employees?
• Do IT and security staff receive role-based technical training?
• Are phishing simulation exercises conducted regularly?
• Is security training mandatory for new employees?
• Does the management body receive specialized cybersecurity briefings?

Encryption & Authentication (NIS2 Art. 21(2)(h), (j), 5 questions)

• Is there an encryption policy covering data at rest and in transit?
• Is TLS 1.2 or higher enforced for all external communications?
• Is multi-factor authentication implemented for all privileged access?
• Are cryptographic key management procedures documented?
• Does your password policy enforce complexity and breach-checking?

Every question counts once. Yes scores 1, Partially scores 0.5, and No or an unanswered question scores 0. Five questions offer three specific options instead (for example "24/7 monitoring", "business hours only", "no formal monitoring"); the middle option counts as partial. Each domain's score is its points divided by its number of questions, and the overall score is the points across all 53 questions.

NIS2 does not define a passing score. Supervisors look at whether your measures are appropriate and proportionate to your risks (Article 21(1)) and whether you can prove it, so read the score as a map of where to work, not as a compliance verdict.

• National law. NIS2 is a directive, so the binding rules are in your country's transposition law, which may add registration duties, deadlines or sector rules. Check the law and the authority in each country where you operate.
• Detailed technical rules for digital providers. DNS providers, cloud and data centre providers, managed (security) service providers, online marketplaces, search engines and social networks must also meet Commission Implementing Regulation (EU) 2024/2690, which sets the measures in much more detail.
• Assessing effectiveness. Article 21(2)(f) requires policies to assess whether your measures work. The check covers this only indirectly (testing, post-incident reviews).
• The precise scope rules. The screening is a first indication. Some entities are in scope whatever their size, and member states can designate others. Use Does NIS2 apply to my company? for the full rules.

For a requirement-by-requirement list to work through after the check, use our NIS2 compliance checklist. The Pro report turns your answers into a remediation plan: every gap with a recommended action, priority and NIS2 reference, in a 30/60/90-day roadmap with a PDF export.