NIS2 gap assessment: know whether you are in scope and what you are missing
Where you stand, and what is missing.
Directive (EU) 2022/2555, known as NIS2, greatly widens the number of organisations subject to cybersecurity obligations. Many SME and mid-cap leaders first ask a simple question: am I in scope, and under which category? The assessment answers this before any compliance spending.
The directive distinguishes two categories, essential and important entities, depending on sector and size. The supervision and penalty regimes differ. A correct classification avoids two costly mistakes: overbuilding a scope that does not require it, or discovering too late an obligation that was ignored.
The assessment then measures the gap between your actual situation and the risk management measures listed in Article 21(2): risk analysis, incident handling, business continuity, supply chain security, cryptography, access control and multi-factor authentication, among others. You get a factual status report and a set of priorities, not a theoretical checklist.
What you get
- Qualification note: sector, size criteria, likely category, points to confirm
- Gap grid across each of the ten Article 21 measures, with observed maturity level
- Mapping of critical assets and dependencies, including suppliers
- Sequenced remediation plan: actions, order, estimated effort, proposed owners
- Presentation to the management committee, with reusable material for internal use
How it runs
Scoping
A discussion with management and the IT lead sets the scope: legal entities, sites and systems concerned. Existing documents are collected from the outset.
Interviews and review
Short interviews with key people, review of policies, supplier contracts and main configurations. The aim is to observe, not to judge.
Gap analysis
Each Article 21 measure is assessed against evidence. Gaps are ranked by risk exposure and correction effort.
Readout
The remediation plan is presented to the management committee. You leave with a decision on how to proceed: in-house, with Valtieri or with another provider.
Frequently asked
Does the assessment make me compliant with NIS2?
No. It establishes your position and the route ahead. Compliance then requires deploying and documenting the measures, which is a separate engagement you remain free to commission or not.
What if my company is not in scope?
The qualification note states this clearly. The assessment remains useful: the Article 21 measures form a reasonable security baseline, often requested by customers who are themselves subject to the directive.
How much of our time will it take?
A few targeted interviews with management, IT and critical business teams, plus the transfer of existing documents. The schedule is set at scoping so as not to disrupt operations.
Further reading
In the same practice area : Security
- Compliance programme
Measures deployed, documented, provable.
- Fractional CISO
Accountability sits with management. We carry the file with them.
- Security tooling integration
A tool installed is not a tool in service.
- Penetration testing
Find the flaws before those who are looking for them.
- Preparation for ISO/IEC 27001 certification
From gap analysis to the certification audit.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
- Incident response retainer
When an incident happens, you know who to call.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call