NIS2 Readiness Self-Assessment
Scores readiness against Articles 20, 21 and 23 and returns the blocking gaps with an effort estimate.
Available soon
Answer it online instead: How ready are we for NIS2?About 25 minutes, free, and nothing is stored.
- Format
- Excel
- Size
- 64 KB
- Length
- 9 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Before you start, confirm the entity is in scope and whether it is essential or important, using the NIS2 Scope & Entity Classification Assessment. Enter the classification and the date of this assessment on the Results sheet. |
| 2 | Assess at least every 6 months, and after a significant incident or a change in scope (NR-08: "Readiness must be self-assessed at least every [[6]] months, and after a significant incident or a change in scope, with every item given a readiness level and its evidence."). |
| 3 | On the Assessment sheet, choose a readiness level for each item from the list. Read the item's 'Operating when' column first: an item is Operating only when it meets all of it and a supervisor could sample the records. When in doubt, choose the lower level. |
| 4 | Record the evidence you looked at, or the fact that decides the level, in the evidence column. Open the document or the record; do not rely on what people say. |
| 5 | For every item below Operating, say what is missing, name one owner, and estimate the effort: Small, under [[2]] weeks of work, inside one team, within budget. Medium, [[2]] to [[8]] weeks, or two or more teams, within budget. Large, more than [[8]] weeks, or money the budget does not hold. The Check column prompts for anything missing. |
| 6 | Use Not applicable only where a duty does not apply to the entity, and give the reason in the evidence column. Counsel should confirm it. |
| 7 | Read the Results sheet: the result, the blocking gaps, the counts by area, and every gap in priority order. A blocking gap must reach the management body quickly (NR-10: "A blocking gap must be reported to the management body at its next meeting, or within [[10]] working days to its chair where the next meeting is later than that."). The sheet gives the date. |
| 8 | Copy every gap into the NIS2 Gap & Remediation Tracker, with its owner, effort and priority (NR-09). The tracker sets the due date and follows it to closure. Keep a copy of each assessment: a supervisor may ask for it (NR-11). |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
The readiness levels:
Not started: Nothing exists yet.
Planned: Owner and approach agreed; not yet in place.
In place: Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.
Operating: Working in full and meeting its own target, with records a supervisor could sample.
Not applicable: The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. It counts neither for nor against the result.
Blocking items. Every item marked Blocking is a duty NIS2 places on the entity directly: scope and registration, the management body's duties, each of the ten measures, and incident reporting. A blocking gap is a duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all. Evidence readiness (SV-01) is the one item that is not blocking.
The result. Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply, with the reason recorded. Until every item has a level, the result reads Incomplete.
Gap priority, by supervisory exposure. Priority 1 (Exposed now): a blocking gap: a duty NIS2 places on the entity directly is not in place at all. Close within 30 days of the assessment. Priority 2 (Exposed on request): a blocking item that is in place but not operating: a request for evidence of implementation (Article 32(2)(g), Article 33(2)(f)) would find it incomplete. Close within 90 days of the assessment. Priority 3 (Improvement): any other item below Operating. Close within 180 days of the assessment. The close-by date here is the latest allowed; the tracker keeps an earlier date where a plan already set one.
The rules this workbook applies: NR-06 ("Each of the ten measures in Article 21(2) must have an owner, the documents that put it in place and records a supervisor could sample. The measures must be proportionate to the risks the risk assessment shows (Article 21(1))."), NR-09 ("Every gap must go into the gap tracker with one owner, a priority set by supervisory exposure, a due date and the change that closes it, and must be corrected without undue delay (Article 21(4)).") and NR-10. The other rules are in the pack's documents.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, dealing in wholesale distribution of food and catering supplies to businesses. Its scope assessment of 8 May 2026 found it an important entity (row ST-13). Its self-assessment as at 30 Sep 2026, by the Head of Information Security: Important entity. Not ready: 1 blocking gap (Article 21(2)(h): cryptography and encryption), due 30 Oct 2026; 6 other items in place but not yet operating.
National law may add duties to the Directive: [[any duty or field the national law adds to the Directive]]. Add each as an item on the blank rows at the foot of the Assessment sheet, with an ID, an area, and whether it is blocking.
Tailoring for a small organisation: a medium-sized entity has the same duties as a large one. One or two people may own most items; estimate effort in the weeks those people really have, not in the weeks the work would take a team.
Tailoring for a regulated entity: an essential entity may be supervised at any time (Article 32), so treat Priority 2 gaps as urgent as well. A financial entity under DORA does not apply the NIS2 provisions that DORA matches (Article 4(1)): with counsel, mark those items Not applicable with that reason, and assess them against DORA instead.
Tailoring for IT run by a service provider: rate an item on what you can show, not on what the provider says. Where the provider runs a measure, the owner is the person who manages the provider, and Operating needs the provider's records to be available to you and to a supervisor.
Limitations: see the foot of the Results sheet.
Assessment
One row per readiness item. Yellow columns are yours; the columns to the right of Effort calculate. Rate each item against its 'Operating when' column.
| Example | Item ID | Area | Requirement | NIS2 reference | Operating when | Blocking? | Readiness level | Evidence and facts (reason, if not applicable) | What is missing (below Operating) | Gap owner (one role) | Effort | Blocking gap? | Gap priority | Close by (latest) | Check | Order (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SR-01 | Scope and registration | Scope and classification decided and recorded | Article 2(1); Article 3(2) | The written assessment gives each answer with its source and reasoning, was confirmed with counsel, approved by the management body and reviewed within the last 12 months or since the last trigger (NR-01). | Yes | Operating | Written assessment of 8 May 2026 (P10 action EA-02), confirmed by counsel and approved by the board on 21 May 2026; no trigger since. | No | None | OK | |||||
| EXAMPLE | SR-02 | Scope and registration | Registered with the competent authority, with details current | Article 3(4) | The Article 3(4) information was submitted and acknowledged, and every change since was notified within two weeks (NR-02). | Yes | Operating | Registered by Legal on 10 Apr 2025, acknowledged 24 Apr 2025; 3 changes since, each notified within two weeks (last on 26 Jun 2026). | No | None | OK | |||||
| EXAMPLE | GV-01 | Management body | The management body approved the measures | Article 20(1) | A minuted approval of the Article 21 measures within the last 12 months, naming what was approved (NR-03). | Yes | Operating | The board approved the measures on 30 Jul 2026 (minute [[B/2026/07-5]]), with measure (h) recorded as outstanding until its policy is approved (decision D-1). | No | None | OK | |||||
| EXAMPLE | GV-02 | Management body | The management body oversees the measures | Article 20(1) | Reports on the measures and the gaps reach the management body every quarter, and its questions and decisions are minuted (NR-04). | Yes | Operating | The board receives the cyber report quarterly (P03); its questions and decisions are minuted. | No | None | OK | |||||
| EXAMPLE | GV-03 | Management body | Every member of the management body trained | Article 20(2) | Every member trained within the last 12 months, and every new member within 3 months of appointment, with the record (NR-05). | Yes | In place | 6 of 7 members trained at the 26 Feb 2026 session (P03 BM-08); the member appointed on 15 Jul 2026 is booked for 8 Oct 2026, inside the 3 months (due 15 Oct 2026). | The member appointed on 15 Jul 2026 is not yet trained | Board secretary | Small | No | Priority 2 | 29 Dec 2026 | OK | 2008 |
| EXAMPLE | RM-a | Risk-management measures | Article 21(2)(a): risk analysis and security policies | Article 21(2)(a) | An approved information security policy and topic policies, reviewed on a set cycle; A risk assessment method and a current risk register, with the treatment chosen for each risk and who accepted what remains; each with an owner and records a supervisor could sample (NR-06). | Yes | Operating | Risk register of 12 top risks reviewed at quarter end, with treatment and acceptance records (P05). | No | None | OK | |||||
| EXAMPLE | RM-b | Risk-management measures | Article 21(2)(b): incident handling | Article 21(2)(b) | An incident management policy and a response plan, with roles and decision rights; A log of incidents with the reporting decision recorded for each, and reviews after serious ones; each with an owner and records a supervisor could sample (NR-06). | Yes | Operating | Incident policy and plan in use: 4 of 4 reports made on time in the quarter (P09 IMM-02). | No | None | OK | |||||
| EXAMPLE | RM-c | Risk-management measures | Article 21(2)(c): business continuity and crisis management | Article 21(2)(c) | Backup arrangements for critical systems, with restore tests recorded; Continuity and recovery plans for critical services, with recovery times; A crisis management arrangement that has been exercised; each with an owner and records a supervisor could sample (NR-06). | Yes | In place | 2 of 5 critical services restored in tests (P03 BM-06); rebuilding the ordering platform's recovery (P05 TA-01) is awaiting board approval. | The ordering platform cannot yet be restored within 24 hours, and three critical services have no restore test | Head of IT | Large | No | Priority 2 | 29 Dec 2026 | OK | 2011 |
| EXAMPLE | RM-d | Risk-management measures | Article 21(2)(d): supply chain security | Article 21(2)(d) | A register of direct suppliers and service providers, tiered by how much the entity depends on them; Assessments and contract clauses in proportion to each tier, taking account of each supplier's own weaknesses and practices (Article 21(3)); each with an owner and records a supervisor could sample (NR-06). | Yes | In place | 9 of 14 critical suppliers assessed (P03 BM-05); the other 5 are booked by 8 Dec 2026 (P06). | Five Tier 1 suppliers not yet assessed | Information Security Manager | Medium | No | Priority 2 | 29 Dec 2026 | OK | 2012 |
| EXAMPLE | RM-e | Risk-management measures | Article 21(2)(e): security in acquisition, development and maintenance | Article 21(2)(e) | Security requirements applied when systems are bought, built or changed; Vulnerabilities found, rated and fixed within set times, with the record; A way for outsiders to report a vulnerability, and how disclosure is handled; each with an owner and records a supervisor could sample (NR-06). | Yes | In place | Critical exposure fixed on time: 81% against a target of 95% by deadline (Priority 1 in 7 days, Priority 2 in 14) (P03 BM-02); the action to bring it back (P05 TA-03) is at risk. | Priority 1 and 2 weaknesses fixed on time below target | Head of IT | Medium | No | Priority 2 | 29 Dec 2026 | OK | 2013 |
| EXAMPLE | RM-f | Risk-management measures | Article 21(2)(f): assessing effectiveness | Article 21(2)(f) | Measures of whether the security measures work, reported to management on a set cycle; Reviews, audits or exercises, with what they found and what was done about it; each with an owner and records a supervisor could sample (NR-06). | Yes | Operating | Quarterly board measures (P03), an exercise programme with after-action reports (P10) and quarterly incident measures (P09). | No | None | OK | |||||
| EXAMPLE | RM-g | Risk-management measures | Article 21(2)(g): cyber hygiene and training | Article 21(2)(g) | Basic rules for staff, such as updates, passwords, locking screens and safe use of email; Security awareness training for staff, with completion records; each with an owner and records a supervisor could sample (NR-06). | Yes | In place | Staff awareness training running with records, but short of its target: 92% of staff trained against a target of 95% (P03 BM-08). | Staff awareness training below its target: 92% of staff trained against 95% | HR Learning Lead | Small | No | Priority 2 | 29 Dec 2026 | OK | 2015 |
| EXAMPLE | RM-h | Risk-management measures | Article 21(2)(h): cryptography and encryption | Article 21(2)(h) | A policy on when and how cryptography and encryption are used, and how keys are managed; Where encryption is not used for data that would call for it, the recorded reason and who accepted it; each with an owner and records a supervisor could sample (NR-06). | Yes | Planned | Encryption is in use, and RA-01 records the six unencrypted laptops the firm accepted (P05). There is no written policy on the use of cryptography and on key management; the Head of Information Security owns writing one. | No written policy on the use of cryptography, encryption and key management | Head of Information Security | Small | Yes | Priority 1 | 30 Oct 2026 | OK | 1016 |
| EXAMPLE | RM-i | Risk-management measures | Article 21(2)(i): people, access and assets | Article 21(2)(i) | Security steps when people join, move and leave; An access control policy and periodic access reviews, with what they removed; An inventory of the assets that matter; each with an owner and records a supervisor could sample (NR-06). | Yes | Operating | Access review UAR-2026-Q3 closed on 29 Sep 2026 (P07); supplier and asset registers kept (P06). | No | None | OK | |||||
| EXAMPLE | RM-j | Risk-management measures | Article 21(2)(j): multi-factor authentication and secured communications | Article 21(2)(j) | Where multi-factor or continuous authentication is used, and where it is not with the reason; How voice, video and text communications inside the entity are secured; A secured way to communicate in an emergency when normal systems are down; each with an owner and records a supervisor could sample (NR-06). | Yes | In place | Multi-factor authentication covers email and remote access, but by text message, which the attacker also phished in INC-2026-017 (P09). The out-of-hours route to the incident manager was fixed on 10 Sep 2026 and is drilled on 6 Oct 2026 (P09 PIA-05, P10). | Second factors sent by text message can be phished | Head of IT | Medium | No | Priority 2 | 29 Dec 2026 | OK | 2018 |
| EXAMPLE | IR-01 | Incident reporting | Significant incidents screened and reported on time | Article 23(4) | Every incident screened against the NIS2 test, and every significant incident reported by its deadlines (P09 IM-06, RD-01 to RD-04), with the record (NR-07). | Yes | Operating | INC-2026-014 was reported as significant: early warning 7 hours 15 minutes after awareness, and every report on time (P09). | No | None | OK | |||||
| EXAMPLE | SV-01 | Supervision | Evidence ready for a supervisor | Article 32(2); Article 33(2) | Every item on the evidence checklist has an owner and is ready, or its gap is in the tracker, so any item can be produced within 5 working days (NR-11). | No | Operating | 13 of 18 evidence items ready; the 4 not fully ready are each behind a gap in the tracker; 1 does not apply. | No | None | OK |
Results
Results
The result, the blocking gaps, readiness by area and every gap in priority order, calculated from the Assessment sheet. Only the yellow settings are yours.
EXAMPLE: the example organisation's self-assessment. Clear the EXAMPLE column and the yellow answers to use your own.
Settings
| Date of this assessment | 30 Sep 2026 | EXAMPLE: the example quarter end. Close-by dates count from it. | |
| Classification (from the scope assessment) | Important | From the NIS2 Scope & Entity Classification Assessment. EXAMPLE: row ST-13. | |
| Next meeting of the management body | 29 Oct 2026 | Used for NR-10. EXAMPLE: the next quarterly board. | |
| Working days to tell the chair (NR-10) | 10 | The [[10]] in NR-10. | |
| Months to the next assessment (NR-08) | 6 | The [[6]] in NR-08. | |
| Assessed by (role) | EXAMPLE: Head of Information Security | The person who rated the items and checked the evidence. | |
The result
| Result | Not ready | Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply, with the reason recorded. | ||||||||
| In one line | Important entity. Not ready: 1 blocking gap, 6 other items below Operating. | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Blocking gaps | 1 | Each is a Priority 1 gap: listed first below, with its effort. | ||||||||
| Tell the management body (NR-10) | To the chair by 2026-10-14: the next meeting, on 2026-10-29, is later than 10 working days. | |||||||||
| Next assessment due (NR-08) | 30 Mar 2027 | Or sooner, after a significant incident or a change in scope. | ||||||||
Readiness by area
| Area | NIS2 | Items | Operating | In place | Planned | Not started | Not applicable | Not assessed | Result: at Operating | Blocking gaps |
|---|---|---|---|---|---|---|---|---|---|---|
| Scope and registration | Articles 2 and 3 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 2 of 2 at Operating | 0 |
| Management body | Article 20 | 3 | 2 | 1 | 0 | 0 | 0 | 0 | 2 of 3 at Operating | 0 |
| Risk-management measures | Article 21 | 10 | 4 | 5 | 1 | 0 | 0 | 0 | 4 of 10 at Operating | 1 |
| Incident reporting | Article 23 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 of 1 at Operating | 0 |
| Supervision | Articles 32 and 33 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 1 of 1 at Operating | 0 |
| All areas | 17 | 10 | 6 | 1 | 0 | 0 | 0 | 10 of 17 at Operating | 1 | |
| Read the counts, not a percentage: an item In place works but is incomplete or has too little record to sample. Items without an Item ID are not counted; Not applicable items are left out of 'at Operating'. | ||||||||||
Effort to close the gaps
| Effort | Priority 1 (blocking) | Priority 2 | Priority 3 | All gaps | What it means | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| Small | 1 | 2 | 0 | 3 | Under [[2]] weeks of work, inside one team, within budget. | |||||
| Medium | 0 | 3 | 0 | 3 | [[2]] to [[8]] weeks, or two or more teams, within budget. | |||||
| Large | 0 | 1 | 0 | 1 | More than [[8]] weeks, or money the budget does not hold. | |||||
| Not estimated | 0 | 0 | 0 | 0 | Enter the effort on the Assessment sheet. | |||||
| All gaps | 1 | 6 | 0 | 7 | ||||||
Every gap, in priority order (copy into the gap tracker)
| No. | Item ID | Requirement | Priority | Level | What is missing | Owner | Effort | Close by (latest) | Row | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | RM-h | Article 21(2)(h): cryptography and encryption | Priority 1, blocking | Planned | No written policy on the use of cryptography, encryption and key management | Head of Information Security | Small | 30 Oct 2026 | 13 | |
| 2 | GV-03 | Every member of the management body trained | Priority 2 | In place | The member appointed on 15 Jul 2026 is not yet trained | Board secretary | Small | 29 Dec 2026 | 5 | |
| 3 | RM-c | Article 21(2)(c): business continuity and crisis management | Priority 2 | In place | The ordering platform cannot yet be restored within 24 hours, and three critical services have no restore test | Head of IT | Large | 29 Dec 2026 | 8 | |
| 4 | RM-d | Article 21(2)(d): supply chain security | Priority 2 | In place | Five Tier 1 suppliers not yet assessed | Information Security Manager | Medium | 29 Dec 2026 | 9 | |
| 5 | RM-e | Article 21(2)(e): security in acquisition, development and maintenance | Priority 2 | In place | Priority 1 and 2 weaknesses fixed on time below target | Head of IT | Medium | 29 Dec 2026 | 10 | |
| 6 | RM-g | Article 21(2)(g): cyber hygiene and training | Priority 2 | In place | Staff awareness training below its target: 92% of staff trained against 95% | HR Learning Lead | Small | 29 Dec 2026 | 12 | |
| 7 | RM-j | Article 21(2)(j): multi-factor authentication and secured communications | Priority 2 | In place | Second factors sent by text message can be phished | Head of IT | Medium | 29 Dec 2026 | 15 | |
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
Order: Priority 1 first, then Priority 2, then Priority 3; within a priority, in the order of the Assessment sheet. The grey Row column is the item's position in the assessment table. The tracker sets each gap's due date: this date or an earlier one a plan already set.
Limitations
This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the blocking items is the best defence against optimism.
It applies NIS2's own duties. It is not legal advice, and it does not check your national law, which may add duties or define terms more closely. Confirm the classification and any Not applicable item with counsel.
A level of Operating on every item makes it likely, not certain, that a supervisor would find the measures in place. Whether each measure is proportionate to your risks (Article 21(1)) is a judgement the risk assessment supports, not this workbook.
Effort is an estimate in bands. Use it to plan and to ask for resources, not as a commitment.
Lists
| Level | YesNo | Effort | AreaName | PriorityName | PriorityDays | ClassList |
|---|---|---|---|---|---|---|
| Not started | Yes | Small | Scope and registration | Priority 1 | 30 | Essential |
| Planned | No | Medium | Management body | Priority 2 | 90 | Important |
| In place | Large | Risk-management measures | Priority 3 | 180 | In scope | |
| Operating | Incident reporting | Ask the authority | ||||
| Not applicable | Supervision | Out of scope |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Readiness level | How far one requirement has got: Not started, Planned, In place or Operating; or Not applicable, with the reason recorded. Levels are words, never a score. |
| Level: Not started | Nothing exists yet. |
| Level: Planned | Owner and approach agreed; not yet in place. |
| Level: In place | Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample. |
| Level: Operating | Working in full and meeting its own target, with records a supervisor could sample. |
| Level: Not applicable | The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. Left out of the counts at Operating. |
| Blocking item | An item marked Blocking: a duty NIS2 places on the entity directly. Below In place it is a blocking gap. |
| Blocking gap | A duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all. |
| Result | Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply, with the reason recorded. Incomplete: an item has no level yet. |
| Priority 1: Exposed now | A blocking gap: a duty NIS2 places on the entity directly is not in place at all. Close within 30 days of the assessment. |
| Priority 2: Exposed on request | A blocking item that is in place but not operating: a request for evidence of implementation (Article 32(2)(g), Article 33(2)(f)) would find it incomplete. Close within 90 days of the assessment. |
| Priority 3: Improvement | Any other item below Operating. Close within 180 days of the assessment. |
| Effort: Small | Under [[2]] weeks of work, inside one team, within budget. |
| Effort: Medium | [[2]] to [[8]] weeks, or two or more teams, within budget. |
| Effort: Large | More than [[8]] weeks, or money the budget does not hold. |
| Essential entity | An entity that Article 3(1) of NIS2 classes as essential: mainly a large entity in an Annex I sector, and some entities whatever their size. Supervised both before and after an incident or complaint (Article 32). |
| Important entity | An entity of a type in Annex I or II that is in scope and is not essential (Article 3(2)). Supervised after the event, when the authority has evidence or an indication that it does not comply (Article 33). |
| Management body | The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. |
| Article 21 measures | The cybersecurity risk-management measures of Article 21: appropriate and proportionate to the risks, and including at least the ten in Article 21(2), points (a) to (j). |
| Significant incident | NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock. |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Supervisory evidence | The documents and records a competent authority may ask for: documented cybersecurity policies and evidence that they are implemented (Article 32(2) and Article 33(2)). |
| NR-01 to NR-12 | The rules of this pack. NR-06, NR-08, NR-09 and NR-10 are quoted on the Instructions sheet. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Clear the EXAMPLE column and the yellow answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.2 — Internal audit | The workbook as a whole: a planned check of readiness, with its results recorded |
| NIST CSF 2.0 | ID.IM-01 — “Improvements are identified from evaluations” | Results: the gaps found, in priority order, for improvement |
| NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | GV-01 and GV-02: the management body approves the measures and oversees them |
| NIS2 — Directive (EU) 2022/2555 | Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices | GV-03: every member of the management body trained |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | RM-a to RM-j: one item for each of the ten measures |
| NIS2 — Directive (EU) 2022/2555 | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | Gap priority and close-by date: corrective measures without undue delay |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) | IR-01: significant incidents reported by the deadlines the incident policy sets |
| NIS2 — Directive (EU) 2022/2555 | Article 3(4) — entities submit at least their name; address and up-to-date contact details, including email addresses, IP ranges and telephone numbers; where applicable, the relevant sector and subsector in Annex I or II; and, where applicable, the Member States where they provide services in scope. They notify any change “without delay, and, in any event, within two weeks of the date of the change”. Member States may set up national mechanisms for entities to register themselves | SR-02: registration submitted and kept current |
| NIS2 — Directive (EU) 2022/2555 | Article 32(2) — for essential entities, supervision includes on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | SV-01: evidence ready for a supervisor of an essential entity |
| NIS2 — Directive (EU) 2022/2555 | Article 33(2) — for important entities, supervision includes on-site inspections and off-site ex post supervision, targeted security audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | SV-01: evidence ready for a supervisor of an important entity |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.