NIS2 Resilience Diagnostic — gap analysis within 48h

Number of employees * Under 20 21–50 51–100 More than 100

1. Board-level ownership of cyber risk * 1 — No one specifically owns it 2 — “That’s an IT matter”, leadership not involved 3 — Owner assigned, discussed only after incidents 4 — Clear ownership, reviewed regularly by leadership 5 — Standing board agenda item, decisions documented

2. Incident response readiness * 1 — No plan exists 2 — A generic document no one knows 3 — Plan exists, team knows it, never tested 4 — Tested plan, clear roles 5 — Tested plan with 24h/72h reporting triggers and named owners

3. Business continuity & recovery testing * 1 — No backup routine, or we don’t know 2 — Backups run, recovery never tested 3 — Recovery tested at least once 4 — Regular tests, results documented 5 — Automated & audited, tested regularly

4. Third-party / supply chain risk oversight * 1 — We don’t assess our suppliers 2 — We rely on trust 3 — Key suppliers assessed, irregularly 4 — Questionnaires and security clauses in contracts 5 — Continuous monitoring, contractual requirements, regular reviews

5. Vulnerability management * 1 — We react only when something happens 2 — Occasional patching, no routine 3 — Regular updates, no scanning 4 — Periodic scanning, prioritised fixes 5 — Continuous scanning with defined remediation deadlines

6. If a NIS2 audit happened tomorrow — how confident are you? * 1 — We would fail 2 — Many gaps, evidence hard to show 3 — Half in order, half not 4 — Broadly ready, details remain 5 — Ready, evidence in order

7. Security documentation (policies, procedures) * 1 — We have no documentation 2 — One general, outdated document 3 — Core documents exist but are never reviewed 4 — Updated, owners assigned 5 — Living documents, reviewed regularly, match actual practice

8. Asset register (which systems and data we hold) * 1 — We do not know exactly what we have 2 — A list exists but is outdated 3 — Register maintained irregularly 4 — Register current, owner assigned 5 — Current, changes tracked, linked to risks

9. Staff training and awareness * 1 — We run no training 2 — One-off induction when joining 3 — Once a year, no verification 4 — Regular training, attendance recorded 5 — Regular training and phishing tests, results measured

10. Access rights and staff turnover * 1 — When someone leaves we revoke access when we remember 2 — We revoke it, but with no process and no record 3 — A process exists, not always followed 4 — Process works, actions are recorded 5 — Automated, access reviewed periodically

11. AI use (ChatGPT, Copilot and similar) * 1 — We do not know who uses it or how 2 — People use it, no rules at all 3 — Verbal recommendations only 4 — A written AI usage policy exists 5 — Policy works: clear what data may be uploaded, usage is logged

12. Evidence for a client or auditor * 1 — We have nothing to show 2 — We would find it, but it would take a long time 3 — We could provide part of it quickly 4 — We could provide most of it within a few days 5 — We have a prepared evidence set