NIS2 Gap Assessment: How to Run One and What to Check

A NIS2 gap assessment compares what your organisation does today with what NIS2 expects, and ends in a ranked list of gaps, owners and a remediation roadmap. You run it in five moves: confirm scope, take the Article 21 measures as your baseline, collect evidence for each one, rate the gaps by risk, and write a report that management can act on. This guide walks through each move and shows what a useful result looks like.

What a NIS2 gap assessment is

A gap assessment takes a requirement, looks at what you actually do, and records the distance between the two. For NIS2 that means your governance, risk management, incident handling, supplier controls and the evidence behind each. The output is a factual view of where you meet the requirement, where you partly meet it and where you do not.

It differs from a compliance audit in purpose and timing. An audit tests conformity against a defined standard and gives a formal conclusion. A gap assessment is an internal or advisory exercise done earlier, so you know what to fix before anyone judges the result. Many teams run a gap assessment first, fix the findings, and only then face an external review.

The directive itself is Directive (EU) 2022/2555, and national laws put it into practice. Your assessment should therefore name both: the directive text for the measures, and your own country’s law for scope, registration and supervision.

Step 1: confirm whether and how NIS2 applies to you

Before you assess controls, settle scope. The EU summary of the directive states that it applies principally to medium-sized and large entities operating in its critical sectors. The European Commission lists those sectors: energy, transport, healthcare, finance, water, digital infrastructure, public electronic communications, digital services, waste and wastewater, manufacturing of critical products, postal and courier services, public administration and space.

National regulators give practical routes to confirm your position. Ireland’s NCSC guidance tells organisations to look at their type and size, the services they provide in the EU, their location, any earlier status under the first NIS Directive, and possible supply-chain relevance. It offers an “Am I in Scope” tool, and it makes clear that the entity must determine its own scope and may need legal advice.

Transposition has moved at different speeds across the Union. The directive’s deadline was 17 October 2024, and the same NCSC page records that Ireland had not met it and that registration was not required until the legislation was enacted and dates published. Check your own national authority for the current position before you fix the assessment’s scope.

Two further scope points belong in the report:

• Financial entities. The Irish NCSC says financial entities within DORA’s scope are exceptions because DORA is lex specialis. If you are one, your assessment centres on DORA, and NIS2 remains relevant to the extent your national law says so.
• Technology and digital service providers. If you operate infrastructure or digital services, a guide to NIS2 scope for technology organisations helps you test whether your services fall in a listed sector.

For a plain overview of who is covered, see our page on NIS2: what it is and who it covers.

Step 2: set the baseline from Article 21(2)

The measures you assess come from Article 21(2) of the directive. ENISA’s technical implementation guidance sets out technical and methodological requirements for those measures. It supports Commission Implementing Regulation (EU) 2024/2690 and applies to the entity types that regulation covers, such as cloud, data centre and managed service providers. Other entities can still use it as a structured reference, together with their national requirements.

A complete baseline covers these ten areas:

1. Risk analysis and information system security policies.
2. Incident handling.
3. Business continuity, backup, disaster recovery and crisis management.
4. Supply chain security.
5. Security in acquisition, development and maintenance, including vulnerability handling.
6. Policies and procedures to assess the effectiveness of measures.
7. Basic cyber hygiene and training.
8. Cryptography and, where appropriate, encryption.
9. Human resources security, access control and asset management.
10. Multi-factor or continuous authentication and secure communications, where appropriate.

Turn each area into a handful of specific questions. For incident handling, for example: is there an approved procedure, who owns it, when was it last exercised, and do the exercises include key suppliers? For access control: who reviews privileged accounts, how often, and where is the record?

Reuse what you already have

If you already run an ISO 27001 management system, much of the baseline is covered. ISO 27001 controls and DORA evidence can often be cross-mapped and reused, according to the ENISA guidance, but neither automatically replaces NIS2. Each framework keeps its own obligations. So a certified information security management system is a strong starting point, and the gap assessment shows the additional NIS2 requirements that remain, such as management accountability, supply chain measures and incident reporting duties.

Our NIST CSF and Cyber Essentials pages explain two other frameworks whose controls often map onto the same areas.

Step 3: collect evidence for each requirement

The most common weakness in a first assessment is evidence. A policy that exists on paper is a start. Assessors and regulators want to see that the control works in practice.

ENISA’s guidance gives a useful list of what to gather:

• approved and current policies;
• risk assessments and treatment plans;
• inventories and network or system diagrams;
• board approvals and training records;
• incident playbooks and incident records;
• technical configuration and monitoring evidence;
• vulnerability and patch reports;
• access and MFA reviews;
• backup and recovery tests;
• supplier assessments and contract clauses;
• audit or test reports.

Link each item to the requirement it supports, and keep evidence that the control operated and was effective over time. The same guidance says its evidence examples are non-exhaustive and do not by themselves establish compliance, so treat them as prompts for your own list.

Check that procedures work, not only exist

Typical findings come from operation. An incident response plan may be approved, yet its contact numbers are out of date. A supplier may be critical to your service and still be left out of exercises. Build a short test into each area: ask the owner to show the last time the control ran and what it produced.

Technical testing supports this step. A vulnerability assessment or application test gives you dated results for the vulnerability handling and secure development measures, and the report becomes part of your evidence record.

Step 4: rate and prioritise the gaps

A list of forty gaps with no order stalls. Rate each by the risk it creates, then decide how to treat it. ENISA recommends a risk-treatment plan that links each identified risk to:

• the associated assets;
• the mitigating measures;
• a treatment option;
• a procedure to assess the effectiveness of the measure;
• implementation timelines;
• responsible roles.

The same guidance asks for management acceptance of risk assessment results and residual risks. That fits NIS2’s emphasis on management accountability: leadership should see the ranked gaps and sign off the decisions.

A practical rating scale uses three inputs: how likely it is that the gap leads to an incident, how serious the impact on your services would be, and how quickly you can close it. Gaps with high impact and low effort go first. Gaps that need budget or a project go into the roadmap with a named owner and a date.

The table is an illustration of how to structure ratings. Your own risk method defines the scale.

Step 5: write the report and keep the record alive

The report is the deliverable management reads. The ENISA guidance points to a report that includes scope and assumptions, methodology, an executive summary, status by domain, evidence gaps, risk-ranked findings, owners, deadlines, management decisions, a roadmap and a verification plan.

A clear layout looks like this:

1. Executive summary: one page with the overall position and the three to five most important gaps.
2. Scope and assumptions: the entities, services and systems covered, and the national law applied.
3. Gap matrix: each Article 21(2) area with its status, finding and evidence reference.
4. Findings and risks: what is missing, what could happen as a result.
5. Actions: owner, deadline and treatment option for each.
6. Roadmap and verification: the order of work and how you will confirm each fix.

After the first report, maintain a versioned evidence record continuously. Belgium’s CCB follows the same sequence in its NIS2 quickstart guide: use its CyFun self-assessment tool for the gap analysis, implement the required measures through a plan, then update the assessment and gather evidence confirming implementation. The point is the loop: assess, fix, re-assess, evidence.

Who should do the assessment

Three set-ups are common:

• Internal team. Works well when you have a security or compliance lead who knows the systems and can ask owners for evidence.
• Specialist support. A virtual security officer can lead the assessment, challenge the ratings and present the results to the board.
• Independent review. A security audit against ISO, NIS2 or DORA adds an outside view once your own gaps are closed.

Whichever you choose, assign a single owner for the report and a named owner for every action.

Run the assessment in one system with Guardiso

A gap assessment produces many moving parts: requirements, risks, documents, tasks and evidence. Spreadsheets handle the first round and struggle with the second. Guardiso is a platform where you manage ISO 27001, GDPR, NIS2, DORA and other standards in one place. Because one set of documents and evidence serves several regulations, the team avoids repeating the same work when a new framework applies. The platform shows compliance status, risks and open tasks, collects evidence from tools such as Microsoft 365, GitHub and AWS through integrations, and before an audit prepares a complete evidence pack for the auditor. Data is stored only in the European Union.

Plans start at €199 per month for Starter and €499 per month for Professional, and Enterprise is priced on request. See the plans and pricing to choose the one that fits your organisation. For how we protect customer data, read about security at Guardiso. Guardiso is an ISO 27001 certified company.

A realistic timeline and common pitfalls

For a mid-sized organisation, the first assessment is mostly a scheduling task. Interviews with owners, evidence requests and technical checks run in parallel, and the writing comes last. Plan for the evidence requests to take the longest, because the material sits with many people.

Watch for these pitfalls:

• Scope drift. Decide early which entities and services are in scope, and write the assumption down.
• Document-only checks. Ask for proof of operation, such as a recent access review or a recovery test result.
• Missing suppliers. Supply chain security is its own measure. Include critical vendors and their contract clauses.
• No owner. A finding without a named person and a date does not move.
• A one-off report. Without a living evidence record, the assessment is out of date within months.

FAQ

Is a NIS2 gap assessment mandatory?

The directive does not name a gap assessment as a required step. It requires appropriate and proportionate risk-management measures, and a gap assessment is the usual way to find out where you stand against them. Check your national law and supervisor for any specific obligations that apply to you.

How is a gap assessment different from a NIS2 audit?

A gap assessment identifies what is missing and ranks it, so you can fix it. An audit tests conformity and reports a formal conclusion. Most organisations assess and remediate first, then submit to an audit or supervisory review.

Can ISO 27001 certification replace the assessment?

No. ISO 27001 controls can often be mapped and reused, and a certified management system gives you a strong base. NIS2 has its own obligations, so the assessment shows what remains on top of your certified system.

Which organisations need to assess against NIS2?

NIS2 applies principally to medium-sized and large entities in the sectors the Commission lists. Your national authority confirms how scope works in your country, and some regulators provide tools to help you check.

Sources

• Cybersecurity of network and information systems (EUR-Lex summary)
• NIS2 Directive: securing network and information systems (European Commission)
• NCSC Ireland: NIS2 FAQ
• ENISA technical implementation guidance on cybersecurity risk management measures
• CCB Safeonweb: NIS2 Quickstart Guide
• Hva er NIS2? (Clevo)

Recommended

• NIS2: what it is, who it covers
• DORA: what it is, who it covers
• TISAX: what it is, who it covers