NIS2 Quick Assessment

Governance & risk management

Policies, accountability, and how risk decisions get made.

Not answered

Has management formally approved an information security policy?

NIS2 makes management bodies personally accountable for approving risk-management measures.

Yes, approved and reviewed at least annually A policy exists but has never been formally approved No policy exists Not sure

Is there a named person accountable for cybersecurity?

A specific individual, not "IT in general".

Yes, a dedicated security role (CISO or equivalent) Yes, but combined with other IT duties Handled entirely by an external provider Nobody is formally accountable

Do you maintain a documented risk register?

Identified risks, their owners, and treatment decisions.

Yes, reviewed on a defined schedule An informal or outdated list exists No risk register Not sure

Incident handling

Detection, response, and the 24-hour reporting obligation.

Not answered

Do you have a documented incident response plan?

Roles, escalation paths, and communication steps written down in advance.

Yes, and it has been tested in the last 12 months Documented but never tested No documented plan Not sure

How would you detect a compromise today?

Consider whether anyone is actually watching the alerts outside office hours.

24/7 monitored SOC or managed detection service Central log collection reviewed during business hours Antivirus alerts only We would most likely find out from a third party

Could you file an early warning to the authorities within 24 hours of a significant incident?

NIS2 requires an early warning within 24 hours and a full notification within 72 hours.

Yes, the process and contacts are defined We know the obligation exists but have no process No, we would not meet that deadline Not sure

Business continuity & backup

Backups, recovery targets, and crisis management.

Not answered

How are your backups protected against ransomware?

Backups reachable with normal admin credentials get encrypted along with everything else.

Offline or immutable copies, separate credentials Cloud backups with the same admin credentials On-site only, always connected No reliable backups

When did you last successfully restore from backup as a test?

An untested backup is a hypothesis, not a control.

Within the last 6 months Within the last year Never tested Not sure

Are recovery time and recovery point objectives defined for critical systems?

How much downtime and how much data loss the business has agreed it can absorb.

Yes, agreed with the business and documented Informally understood but not documented Not defined Not sure

Supply chain security

Supplier risk, contracts, and third-party access.

Not answered

Do you maintain an inventory of suppliers with access to your systems or data?

Including SaaS vendors and managed service providers.

Yes, with a criticality rating per supplier A partial list exists No inventory Not sure

Do supplier contracts include security requirements and breach notification duties?

NIS2 pushes obligations down the supply chain to your vendors.

Yes, in all critical supplier contracts In some contracts No security clauses Not sure

How is third-party remote access to your network controlled?

Vendor remote access is a recurring initial access vector.

Time-limited, MFA-protected, and logged Standing VPN accounts with MFA Standing accounts, no MFA No third-party access / not sure

Access control & cryptography

Authentication, privilege management, and encryption.

Not answered

Is multi-factor authentication enforced on remote access and email?

NIS2 Article 21(2)(j) explicitly names multi-factor authentication.

Yes, on all accounts including administrators On some systems or some users only Not enforced Not sure

How are administrator accounts managed?

Shared admin passwords make attribution impossible after an incident.

Separate named accounts, vaulted, access reviewed regularly Separate named accounts, no formal review Shared administrator credentials Not sure

Is sensitive data encrypted at rest on laptops and servers?

Full-disk encryption on endpoints, plus encryption for sensitive databases.

Yes, enforced by policy and verified On some devices No encryption at rest Not sure

Cyber hygiene & training

Patching, vulnerability handling, and staff awareness.

Not answered

How quickly are critical security patches applied?

Measured from vendor release to deployment on production systems.

Within 14 days, tracked and reported Within a month, best effort Irregularly, when someone gets to it Not sure

Do you run vulnerability scanning or penetration testing?

Article 21(2)(e) covers vulnerability handling and disclosure.

Regular scanning plus annual penetration testing Vulnerability scanning only Occasionally, no schedule Neither

Do staff receive security awareness training?

NIS2 requires training for management bodies specifically, not just staff.

Yes, including management, with phishing simulations Staff only, management exempt Only at onboarding No training

Where should we send the results?

Our team reviews every assessment and follows up with the detail.

Organisation * Your name * Email * Phone * Company size * Sector *

Anything else we should know? I would also like to receive occasional emails about services and security guidance. (Optional)

By submitting this assessment you agree to our Privacy Policy.

Website

NIS2 Quick Assessment

Governance & risk management

Incident handling

Business continuity & backup

Supply chain security

Access control & cryptography

Cyber hygiene & training

Where should we send the results?

Address

Contacts