Assessment
NIS2 quick assessment
You need a clear picture quickly, before deciding on a larger project. In 10 working days we assess your organisation against the NIS2 risk-management measures and leave a short management report with a preliminary status, the main risks identified and a plan for the next 90 days.
Scope and price are confirmed in writing before work starts.
Discuss your caseWhen you need this service
- You do not know where to start with NIS2 (EU cybersecurity directive).
- Management wants a quick picture and budget before deciding on a larger project.
- An authority or customer asks what you have done and you have no summary.
The benefit for your organisation
- In 10 working days management knows where the organisation stands against NIS2.
- You know the main risks identified and where to start.
- You decide on a larger project with a clear picture and budget.
Quick assessment
Two interviews (management and IT), a review of key documents, a preliminary status for each measure, the main risks identified and a 90-day plan. A report and a meeting with management.
from €2 90010 working days
Full assessment and evidence pack
When you need evidence for a review or audit: a requirement–status–evidence–gap–action matrix and organised evidence.
from €7 900usually 3–5 weeks
Sample output
Demonstration example — not a real client.
| NIS2 measure | Status | Basis | Next step |
|---|---|---|---|
| Risk analysis | partial | A register exists but has not been reviewed since 2024 | Review within 30 days |
| Incident handling | missing | No documented 24/72-hour reporting procedure | Procedure and contacts |
| Backups | unconfirmed | No restore-test record provided | Restore test with a record |
| Multi-factor authentication | stated, unconfirmed | From interview: enabled for administrators | Check the settings and all relevant access |
What is the difference
The quick assessment shows where you stand and where to start. It relies on interviews and key documents and does not check evidence for each requirement. The full assessment checks the evidence and prepares you for a review by the authority or an audit.
What we assess
- The NIS2 risk-management measures (Art. 21(2)): risk analysis, incident handling, continuity and crisis management, supply chain, acquisition and development including vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, HR security, access and assets, multi-factor authentication and secure communications.
- Governance: whether management approves and oversees the measures (Art. 20) and has completed training.
- Readiness to report: an early warning within 24 hours and a notification within 72 hours (Art. 23).
What you receive
- A preliminary status for each measure based on interviews and the documents provided: in place, partial, missing or unconfirmed (insufficient information).
- The main risks to your services identified, in priority order.
- A plan for the next 90 days: actions, owners and what your own team can do.
- A meeting with management to present the result.
Base scope
One organisation of up to 100 staff, two interviews and a review of the key documents you provide. Larger organisations or more units are quoted in writing.
Boundaries
- The quick assessment does not check evidence for each requirement and is not an audit or a compliance assessment.
- It is not a legal opinion on whether you are in scope. That is the applicability assessment; for a first indication there is a free self-check.
General information, not a legal opinion.