NIS2 Gap & Remediation Tracker

Converts readiness gaps into owned, dated actions prioritised by supervisory exposure.

Available soon

Format: Excel
Size: 81 KB
Length: 10 sheets
Version: 1.0
Updated: 29 Sep 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Gaps
Readiness Items
Summary
Lists
Definitions
Framework References

What changed

1.029 Sep 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date and the date of the next management body meeting on the Summary sheet. The EXAMPLE uses 30 Sep 2026, the example quarter end; use today's date, or type =TODAY().
2	After each self-assessment, enter the level of every item on the Readiness Items sheet. Its Check column shows any item below Operating with no open gap: raise one (NR-09).
3	Raise one gap per item below Operating on the Gaps sheet: its ID (GAP-nn), the readiness item, the level it had when the gap was raised, and what is missing, as fact. The priority and the supervisory exposure calculate.
4	Enter the change that closes the gap (the document, control or record it adds or changes), one owner, the effort, and the date raised: the date of the assessment. If a plan already set an earlier date, enter it as the earlier planned date. The due date calculates.
5	Keep the status current: Open, agreed, not started. In progress, work started; due date unchanged. Done, the change is made and its record is filed; the item is re-rated at the next assessment. Withdrawn, dropped, with the management body's recorded reason.
6	When a gap is Done, enter the date and where its record is filed, so the evidence checklist can point to it. The next self-assessment re-rates the item; do not change the level on the Readiness Items sheet until then.
7	Report to the management body at least every quarter (NR-04), and report a Priority 1 gap at once (NR-10: "A blocking gap must be reported to the management body at its next meeting, or within [[10]] working days to its chair where the next meeting is later than that."). The Summary sheet shows what falls due before the next meeting.
8	Delete the EXAMPLE rows on the Gaps sheet, and the EXAMPLE levels on the Readiness Items sheet, before the tracker is approved. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

NR-09: "Every gap must go into the gap tracker with one owner, a priority set by supervisory exposure, a due date and the change that closes it, and must be corrected without undue delay (Article 21(4))."

Why priority follows supervisory exposure: a supervisor weighs most a duty not met at all, and asks for evidence that measures are implemented (Article 32(2) and Article 33(2)). Priority 1 (Exposed now): A blocking gap: a duty NIS2 places on the entity directly is not in place at all. Priority 2 (Exposed on request): A blocking item that is in place but not operating: a request for evidence of implementation (Article 32(2)(g), Article 33(2)(f)) would find it incomplete. Priority 3 (Improvement): Any other item below Operating.

This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its self-assessment of 30 Sep 2026 gave Not ready with 1 blocking gap and raised 7 gaps. Where a plan had already set an earlier date (the board member's booked training, the recovery rebuild, the supplier assessments, the patching action) the due date follows it. GAP-01 goes to the chair of the management body by 14 Oct 2026: the next meeting, on 29 Oct 2026, is 21 working days after the assessment, more than NR-10's 10 (NR-10).

Tailoring for a small organisation: one person may own most gaps. Keep one owner per gap all the same, and check the due dates against that person's real time: an overdue Priority 1 gap is the one a supervisor would find first.

Tailoring for a regulated entity: an essential entity may be supervised at any time (Article 32), so a Priority 2 gap is exposed as soon as a supervisor asks. A financial entity under DORA tracks the gaps against DORA's requirements in the same way, with counsel's view of which NIS2 provisions do not apply (Article 4(1)).

Tailoring for IT run by a service provider: where the provider must make the change, the owner is the person who manages the provider, and the change names the contract clause or the service request. A gap is Done only when you hold the provider's record.

Gaps

One row per gap, from the NIS2 Readiness Self-Assessment. Yellow columns are yours; priority, exposure, due date and flag calculate. Overdue is measured at the As-at date on the Summary sheet.

Example	Gap ID	Readiness item	Requirement	What is missing	Level when raised	Blocking item?	Priority	Supervisory exposure	Change that closes it	Owner	Effort	Raised	Earlier planned date	Due	Status	Flag
EXAMPLE	GAP-01	RM-h	Article 21(2)(h): cryptography and encryption	No written policy on the use of cryptography, encryption and key management	Planned	Yes	Priority 1	Exposed now	Write the policy and have the board approve it on 29 Oct 2026, completing its approval of the measures (NR-03)	Head of Information Security	Small	30 Sep 2026		30 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-02	GV-03	Every member of the management body trained	The member appointed on 15 Jul 2026 is not yet trained	In place	Yes	Priority 2	Exposed on request	Induction training on 8 Oct 2026, recorded in the training plan	Board secretary	Small	30 Sep 2026	15 Oct 2026	15 Oct 2026	Open	Not yet due
EXAMPLE	GAP-03	RM-c	Article 21(2)(c): business continuity and crisis management	The ordering platform cannot yet be restored within 24 hours, and three critical services have no restore test	In place	Yes	Priority 2	Exposed on request	Rebuild the platform's recovery (P05 TA-01), then test a restore of every critical service	Head of IT	Large	30 Sep 2026	15 Dec 2026	15 Dec 2026	Open	Not yet due
EXAMPLE	GAP-04	RM-d	Article 21(2)(d): supply chain security	Five Tier 1 suppliers not yet assessed	In place	Yes	Priority 2	Exposed on request	Complete the five assessments booked for Q4 (P06)	Information Security Manager	Medium	30 Sep 2026	8 Dec 2026	8 Dec 2026	In progress	Not yet due
EXAMPLE	GAP-05	RM-e	Article 21(2)(e): security in acquisition, development and maintenance	Priority 1 and 2 weaknesses fixed on time below target	In place	Yes	Priority 2	Exposed on request	Bring patching of the ordering platform back within deadline (P05 TA-03)	Head of IT	Medium	30 Sep 2026	31 Oct 2026	31 Oct 2026	In progress	Not yet due
EXAMPLE	GAP-06	RM-j	Article 21(2)(j): multi-factor authentication and secured communications	Second factors sent by text message can be phished	In place	Yes	Priority 2	Exposed on request	Move email and remote access to an authenticator app or security keys	Head of IT	Medium	30 Sep 2026		29 Dec 2026	Open	Not yet due
EXAMPLE	GAP-07	RM-g	Article 21(2)(g): cyber hygiene and training	Staff awareness training below its target: 92% of staff trained against 95%	In place	Yes	Priority 2	Exposed on request	Train the staff still to complete the course, starting with the warehouse shifts, and keep the completion record (P03 BM-08)	HR Learning Lead	Small	30 Sep 2026		29 Dec 2026	In progress	Not yet due

Readiness Items

The items of the NIS2 Readiness Self-Assessment, with the level each had at the latest assessment. Blocking items are duties NIS2 places on the entity directly. Add any item of your own on a blank row.

Example	Item ID	Area	Requirement	Blocking?	Latest level	Open gaps	Check (NR-09)
EXAMPLE	SR-01	Scope and registration	Scope and classification decided and recorded	Yes	Operating	0	OK
EXAMPLE	SR-02	Scope and registration	Registered with the competent authority, with details current	Yes	Operating	0	OK
EXAMPLE	GV-01	Management body	The management body approved the measures	Yes	Operating	0	OK
EXAMPLE	GV-02	Management body	The management body oversees the measures	Yes	Operating	0	OK
EXAMPLE	GV-03	Management body	Every member of the management body trained	Yes	In place	1	OK
EXAMPLE	RM-a	Risk-management measures	Article 21(2)(a): risk analysis and security policies	Yes	Operating	0	OK
EXAMPLE	RM-b	Risk-management measures	Article 21(2)(b): incident handling	Yes	Operating	0	OK
EXAMPLE	RM-c	Risk-management measures	Article 21(2)(c): business continuity and crisis management	Yes	In place	1	OK
EXAMPLE	RM-d	Risk-management measures	Article 21(2)(d): supply chain security	Yes	In place	1	OK
EXAMPLE	RM-e	Risk-management measures	Article 21(2)(e): security in acquisition, development and maintenance	Yes	In place	1	OK
EXAMPLE	RM-f	Risk-management measures	Article 21(2)(f): assessing effectiveness	Yes	Operating	0	OK
EXAMPLE	RM-g	Risk-management measures	Article 21(2)(g): cyber hygiene and training	Yes	In place	1	OK
EXAMPLE	RM-h	Risk-management measures	Article 21(2)(h): cryptography and encryption	Yes	Planned	1	OK
EXAMPLE	RM-i	Risk-management measures	Article 21(2)(i): people, access and assets	Yes	Operating	0	OK
EXAMPLE	RM-j	Risk-management measures	Article 21(2)(j): multi-factor authentication and secured communications	Yes	In place	1	OK
EXAMPLE	IR-01	Incident reporting	Significant incidents screened and reported on time	Yes	Operating	0	OK
EXAMPLE	SV-01	Supervision	Evidence ready for a supervisor	No	Operating	0	OK

Summary

Summary

Calculated from the Gaps sheet at the As-at date. Take it to the management body with the quarterly report (NR-04).

EXAMPLE: the example organisation's gaps. Delete the EXAMPLE rows to use your own.

As-at date	30 Sep 2026	EXAMPLE: the example quarter end. Use today's date, or type =TODAY().
Next management body meeting	29 Oct 2026	EXAMPLE: the next quarterly board.

Headline

Measure	Result
Open gaps (Open or In progress)	7
Priority 1 open: blocking gaps	1
Overdue	0
Next due date	15 Oct 2026
Next due gap	GAP-02
Due on or before the next management body meeting	1
Items below Operating with no open gap (NR-09)	0

Gaps by priority

Priority	Exposure	Deadline (days)	Open	In progress	Earliest open due
Priority 1	Exposed now	30	0	1	30 Oct 2026
Priority 2	Exposed on request	90	3	3	15 Oct 2026
Priority 3	Improvement	180	0	0
All priorities			3	4	15 Oct 2026

Open gaps by effort

Effort	What it means	Priority 1 (blocking)	Priority 2	All open
Small	Under [[2]] weeks of work, inside one team, within budget.	1	2	3
Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.	0	3	3
Large	More than [[8]] weeks, or money the budget does not hold.	0	1	1

Open gaps by owner

Owner	Open	Earliest open due
Head of Information Security	1	30 Oct 2026
Board secretary	1	15 Oct 2026
Head of IT	3	31 Oct 2026
Information Security Manager	1	8 Dec 2026
HR Learning Lead	1	29 Dec 2026

Type each owner once, as the Gaps sheet names them. EXAMPLE: the owners of the seven example gaps.

Report to the management body

Item	Entry
Reported by (name, role) and date	[[Name, role, YYYY-MM-DD]]
Priority 1 gaps reported under NR-10: to whom and when	EXAMPLE: GAP-01 to the chair of the management body by 2026-10-14, by the NIS2 lead; the next meeting, on 2026-10-29, is 21 working days away, more than 10. Status at 2026-09-30: due
Gaps withdrawn, with the management body's reason and minute reference	[[e.g. none]]
Decisions asked of the management body	[[e.g. approve the cryptography policy as part of the measures]]

Lists

ItemID	Level	Effort	GapStatus	PriorityName	PriorityDays	PriorityExposure
SR-01	Not started	Small	Open	Priority 1	30	Exposed now
SR-02	Planned	Medium	In progress	Priority 2	90	Exposed on request
GV-01	In place	Large	Done	Priority 3	180	Improvement
GV-02	Operating		Withdrawn
GV-03	Not applicable
RM-a	Not applicable

RM-b

RM-c

RM-d

RM-e

RM-f

RM-g

RM-h

RM-i

RM-j

IR-01

SV-01

Definitions

Definitions

Term	Meaning in this workbook
Gap	A readiness item below Operating at the latest self-assessment, and the work that brings it there.
Blocking gap	A duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all.
Priority 1: Exposed now	A blocking gap: a duty NIS2 places on the entity directly is not in place at all. Due within 30 calendar days of the date raised, or by an earlier date a plan already set.
Priority 2: Exposed on request	A blocking item that is in place but not operating: a request for evidence of implementation (Article 32(2)(g), Article 33(2)(f)) would find it incomplete. Due within 90 calendar days of the date raised, or by an earlier date a plan already set.
Priority 3: Improvement	Any other item below Operating. Due within 180 calendar days of the date raised, or by an earlier date a plan already set.
Status: Open	Agreed, not started.
Status: In progress	Work started; due date unchanged.
Status: Done	The change is made and its record is filed; the item is re-rated at the next assessment.
Status: Withdrawn	Dropped, with the management body's recorded reason.
Effort: Small	Under [[2]] weeks of work, inside one team, within budget.
Effort: Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.
Effort: Large	More than [[8]] weeks, or money the budget does not hold.
Field: Gap ID	GAP-nn
Field: Readiness item	The A04 item it comes from
Field: What is missing	Fact, not opinion
Field: Priority	Calculated from the item's blocking flag and its level when raised
Field: Change that closes it	The document, control or record it adds or changes
Field: Owner	One role
Field: Effort	Small, Medium or Large
Field: Raised	Date of the assessment
Field: Due	The priority's deadline, or an earlier planned date
Field: Status	Open, In progress, Done or Withdrawn
Field: Done	Date the change was made
Field: Evidence	Where the record is, for the evidence checklist
Readiness level	How far one requirement has got: Not started, Planned, In place or Operating; or Not applicable, with the reason recorded. Levels are words, never a score.
Level: Not started	Nothing exists yet.
Level: Planned	Owner and approach agreed; not yet in place.
Level: In place	Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.
Level: Operating	Working in full and meeting its own target, with records a supervisor could sample.
Level: Not applicable	The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel.
Overdue	A gap Open or In progress whose due date is before the As-at date.
Supervisory evidence	The documents and records a competent authority may ask for: documented cybersecurity policies and evidence that they are implemented (Article 32(2) and Article 33(2)).
NR-01 to NR-12	The rules of this pack. NR-09 and NR-10 are quoted on the Instructions sheet.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete the EXAMPLE rows before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Gaps: each nonconformity corrected, with its cause, the change and the record
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	The tracker: improvements identified from the self-assessment, owned and dated
NIS2 — Directive (EU) 2022/2555	Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures”	The tracker as a whole: every gap corrected without undue delay, with an owner and a due date
NIS2 — Directive (EU) 2022/2555	Article 32(7) — enforcement takes account of the seriousness of the infringement, where serious infringements include repeated violations, “a failure to notify or remedy significant incidents”, a failure to remedy deficiencies following binding instructions, obstruction of audits, and false or grossly inaccurate information about the Article 21 measures or Article 23 reporting; and of its duration, earlier infringements, damage, intent or negligence, mitigation, certification and cooperation	Priority: a duty not met at all first, as a supervisor weighs it
NIS2 — Directive (EU) 2022/2555	Article 33(1) — for important entities, the competent authorities act, where necessary, through ex post supervisory measures when given evidence, indication or information that the entity allegedly does not comply, in particular with Articles 21 and 23	Priority 2: gaps a supervisor of an important entity would find when acting on evidence or an indication
NIS2 — Directive (EU) 2022/2555	Article 33(5) — “Article 32(6), (7) and (8) shall apply mutatis mutandis” to important entities	The Summary: the same seriousness and accountability apply to important entities

Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.