Tools · NIS2 Implementation & Readiness
How ready are we for NIS2?
Rate 17 readiness items against what NIS2 asks of the entity. You get the result in words, the blocking gaps, and every gap in priority order. Free, no account, and nothing is stored.
Part 1 of 5 · 0 of 17 answered
Scope and registration
Articles 2 and 3
Confirm first that the entity is in scope, with the NIS2 Scope & Entity Classification Assessment. Read each item's 'Operating when' first: an item is Operating only when it meets all of it and a supervisor could sample the records. When in doubt, choose the lower level.
You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.
- About 25 minutes
- Nothing is stored, not even in your browser: reloading starts again
- Also as a workbook: NIS2 Readiness Self-Assessment
How this is worked out, and what it is not
- Blocking items. Every item marked Blocking is a duty NIS2 places on the entity directly: scope and registration, the management body's duties, each of the ten measures, and incident reporting. A blocking gap is a duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all. Evidence readiness (SV-01) is the one item that is not blocking.
- The result. Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply, with the reason recorded. Until every item has a level, the result reads Incomplete.
- Gap priority, by supervisory exposure. Priority 1 (Exposed now): a blocking gap: a duty NIS2 places on the entity directly is not in place at all. Close within 30 days of the assessment. Priority 2 (Exposed on request): a blocking item that is in place but not operating: a request for evidence of implementation (Article 32(2)(g), Article 33(2)(f)) would find it incomplete. Close within 90 days of the assessment. Priority 3 (Improvement): any other item below Operating. Close within 180 days of the assessment. The close-by date here is the latest allowed; the tracker keeps an earlier date where a plan already set one.
Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.
- This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the blocking items is the best defence against optimism.
- It applies NIS2's own duties. It is not legal advice, and it does not check your national law, which may add duties or define terms more closely. Confirm the classification and any Not applicable item with counsel.
- A level of Operating on every item makes it likely, not certain, that a supervisor would find the measures in place. Whether each measure is proportionate to your risks (Article 21(1)) is a judgement the risk assessment supports, not this tool.