Free NIS2 gap analysis tool
See how close you are to the requirements of NIS2 and its national implementation. You answer the questions area by area (about 15 minutes) and get your result instantly: an overall maturity percentage and a score for every area. Open the full report with recommendations, legal basis and the top 10 priorities for free with one click, no e-mail needed.
How to rate the requirements (scale 1 to 5)
The questions cover management oversight, risk analysis and policies, incident handling and reporting, business continuity, supply chain security and the technical measures of Art. 21 NIS2. For each requirement choose the level that best describes the situation today, not the plan for next quarter. If you have no evidence (a document, a record, a report), choose the lower level.
- 1None: the activity is neither performed nor planned.
- 2Planned: there is a decision or plan, but implementation has not started.
- 3In progress: implementation is under way, it works partially and documentation is incomplete.
- 4Implemented: it works and is documented, people are trained, but there is no systematic measurement yet.
- 5Optimized: it works, is measured, reviewed and improved in a regular cycle.
- n/aNot applicable: only for selected questions; the requirement does not apply (justify this in your documentation). It does not affect the score.
Your answers are stored only in your browser; you can stop and come back later. The result appears after the last area, or earlier once you have answered at least 60% of the questions.
Frequently asked questions
What is a NIS2 gap analysis?
A comparison of your current practices with the requirements of the NIS2 Directive (EU) 2022/2555 and its national implementation (in Poland, the amended Act on the National Cybersecurity System, KSC): management accountability, the Art. 21 risk-management measures, incident handling and reporting, and supply chain security.
Who is covered by NIS2?
Medium-sized and large entities in the sectors listed in Annexes I and II of the directive, and in some cases smaller ones regardless of size. Entities are classified as essential or important; the obligations are similar, while supervision and fine levels differ.
What are the incident reporting deadlines?
NIS2 requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report no later than one month after the notification (Art. 23). The national law sets out the exact procedure and recipients; in Poland, reports go through the S46 system.
Is management personally accountable?
Yes. Management bodies approve the cybersecurity risk-management measures, oversee their implementation and must follow cybersecurity training (Art. 20 NIS2). National laws provide for management liability for breaches, including fines.
Should a bank or an insurer use this analysis?
Usually not. Banking and financial market infrastructure are listed in NIS2, but DORA is the sector-specific act for them (Art. 4 NIS2): ICT risk management and incident reporting follow DORA rather than NIS2. Insurers are not listed in NIS2 at all, while DORA covers them. Such entities should use the DORA gap analysis.
Related tools
This tool is for information and self-assessment only. It is not legal advice, an audit or a conformity assessment, and it does not replace an analysis by a specialist. The result depends on the accuracy of your answers. Need a second opinion? Talk to us.