Assessment
NIS2 quick assessment
You need a clear picture quickly, before deciding on a larger project. In 10 working days we assess your organisation against the NIS2 risk-management measures and leave a short management report with a preliminary status, the main risks identified and a plan for the next 90 days.
Scope and price are confirmed in writing before work starts.
Discuss your caseThe benefit for your organisation
- In 10 working days management knows where the organisation stands against NIS2.
- You know the main risks identified and where to start.
- You decide on a larger project with a clear picture and budget.
Quick assessment
Two interviews (management and IT), a review of key documents, a preliminary status for each measure, the main risks identified and a 90-day plan. A report and a meeting with management.
from €2 90010 working days
Full assessment and evidence pack
When you need evidence for a review or audit: a requirement–status–evidence–gap–action matrix and organised evidence.
from €7 900usually 3–5 weeks
What is the difference
The quick assessment shows where you stand and where to start. It relies on interviews and key documents and does not check evidence for each requirement. The full assessment checks the evidence and prepares you for a review by the authority or an audit.
What we assess
- The NIS2 risk-management measures (Art. 21(2)): risk analysis, incident handling, continuity and crisis management, supply chain, acquisition and development including vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, HR security, access and assets, multi-factor authentication and secure communications.
- Governance: whether management approves and oversees the measures (Art. 20) and has completed training.
- Readiness to report: an early warning within 24 hours and a notification within 72 hours (Art. 23).
What you receive
- A preliminary status for each measure based on interviews and the documents provided: in place, partial, missing or unconfirmed (insufficient information).
- The main risks to your services identified, in priority order.
- A plan for the next 90 days: actions, owners and what your own team can do.
- A meeting with management to present the result.
After the review we can implement the agreed measures or coordinate your team or a suitable partner. Implementation is quoted separately.
Base scope
One organisation of up to 100 staff, two interviews and a review of the key documents you provide. Larger organisations or more units are quoted in writing.
Boundaries
- The quick assessment does not check evidence for each requirement and is not an audit or a compliance assessment.
- It is not a legal opinion on whether you are in scope. That is the applicability assessment; for a first indication there is a free self-check.
General information, not a legal opinion.