NIS2 Readiness Roadmap

Find your biggest NIS2 gaps in minutes, with clear next steps.

Identify NIS2 readiness in areas like access control, patching, and data protection.
Pinpoint specific gaps in your current endpoint security and governance.
Receive a tailored report with actionable recommendations.
Prioritise improvements more confidently with clearer visibility of what to fix first.
Get a free follow-up consultation with a NIS2 expert to talk through findings.

NIS2 Readiness Assessment

Facebook

This field is for validation purposes and should be left unchanged.

Company Name(Required)

Job Title(Required)

Number of Employees(Required)

Location(Required)

Identity

This section assesses your organisation’s ability to identify and understand cybersecurity risks related to its systems, users, data, and capabilities.

Are your organisation’s assets covered by information and cybersecurity policies, ensuring these policies are documented, reviewed, and updated when necessary?(Required)

Yes, all assets are fully covered by our information and cybersecurity policies.

Partially, not all assets are included in our information and cybersecurity policies.

Partially, some aspects of our policies are incomplete or not reviewed regularly.

No, there is no policy in place.

Not sure.

Does your organisation have a process to monitor, identify, and document vulnerabilities and weaknesses across its endpoints?(Required)

Yes, we have a formal process that covers all these areas.

Partially, but some areas are not consistently monitored or documented.

No, we do not have a formal process for managing vulnerabilities in our endpoints.

Not sure.

Has your organisation clearly defined its risk tolerance for all its endpoints, particularly in the context of NIS2?(Required)

Yes, our risk tolerance is clearly defined for all endpoints.

Partially, we have a defined risk tolerance for some endpoints.

We are currently in the process of defining it.

No, we have not defined a risk tolerance for our endpoints.

Not sure.

Protect

This section evaluates the safeguards in place to mitigate or contain cyber risks.

Are your endpoints enrolled in a Unified Endpoint Management (UEM) solution and managed according to your security policies?(Required)

Yes, all endpoints are fully enrolled in a UEM solution and managed in compliance with our organisation’s security policies.

Yes, but only some endpoints are enrolled in the UEM solution and managed according to our security policies.

No, but we are planning to enroll our endpoints in a UEM solution.

No, our endpoints are not enrolled in a UEM solution and are not currently managed according to security policies.

Not sure.

How is access control managed to safeguard critical network systems? Please select all that apply.(Required)

Multi-factor authentication (MFA) for all users.

Access based on user roles, following least privilege principles.

A centralised identity and access management (IAM) system.

Local accounts with strong password policies.

Biometric authentication (e.g., fingerprint or facial recognition).

There is no formal access control policy in place.

Not sure.

Are all end users required to use a VPN when accessing the organisation’s critical systems remotely?(Required)

Yes, all users must use a VPN for remote access on public Wi-Fi.

Some users use a VPN, but it’s not mandatory for everyone.

No, users are not required to use a VPN.

Not sure.

How is network traffic monitored for potential security incidents?(Required)

Continuous 24/7 monitoring.

Regular scheduled checks.

Incident reporting only during business hours.

No formal monitoring in place.

Not sure.

Is your organisation using an identity and access management (IAM) solution to manage access permissions and authorisations, ensuring that the principles of least privilege and separation of duties are applied?(Required)

Yes, we use an IAM solution and fully implement least privilege and separation of duties.

Yes, we use an IAM solution, but least privilege and separation of duties are only partially implemented.

No, we do not use an IAM solution, but we manage permissions manually.

No, we do not have a formal process for managing access permissions and authorisations.

Not sure.

Do you have firewall configurations in place to limit network access?(Required)

Yes, firewalls are configured with strict access rules.

Yes, firewalls are enabled but with default settings.

Firewalls are only used on certain endpoints.

No, there are no firewall configurations in place.

Not sure.

Is there a policy in place that requires the use of encryption for both data-at-rest and data-in-transit?(Required)

Yes, we have a comprehensive encryption policy for both data-at-rest and data-in-transit.

Yes, but it only covers either data-at-rest or data-in-transit, not both.

No, but we are planning to implement an encryption policy.

No, we do not have an encryption policy in place.

Not sure.

What actions is your organisation taking to prevent data leaks? Please select all that apply:(Required)

Has your organisation developed, documented, and maintained a baseline configuration for its endpoints, incorporating key security principles such as least functionality?(Required)

Yes, we have a comprehensive baseline configuration for all endpoints, including current version numbers, patch information, configuration settings, and network topology.

Yes, but the baseline configuration is only partially documented for some endpoints.

No, but we are planning to implement and document a baseline configuration for our endpoints.

Not sure.

Do you have patch management in place to ensure your endpoints and applications are consistently updated to the latest versions?(Required)

Yes, automated patch management is fully in place for both endpoints and applications.

Patch management is in place, but some endpoints or applications are updated manually.

Patches are applied manually for both endpoints and applications.

No patch management system is currently in place.

Not sure.

How quickly do you apply critical security patches after they are released?(Required)

Within 24 hours or release.

Within 1 week of release.

Within 1 month of release.

Patches are applied irregularly with no set timeframe.

Not sure.

Do you use a custom Software Update Server to control which updates are approved and deployed?(Required)

Yes, we use a custom Software Update Server to whitelist and manage approved updates.

Some updates are managed through a custom server, but not all.

Updates are approved manually without a custom server.

No custom Software Update Server is in place.

Not sure.

Do you use a tool to monitor operating system upgrades in real-time, ensuring your endpoints are always running the latest and most secure version?(Required)

Yes, real-time monitoring is in place for the entire fleet.

Monitoring is in place, but it’s not real-time or comprehensive.

Monitoring is done manually or periodically.

No monitoring tool is in place for operating system updates.

Not sure.

Do you have a rollback or recovery procedure in place in case an update causes issues?(Required)

Yes, we have a robust rollback plan for any failed updates.

Rollback options are available but not always reliable.

Rollback options are limited or difficult to implement.

There is no rollback or recovery plan in place for update failures.

Not sure.

Does your organisation have a process in place for managing audit/log records, ensuring they are determined, documented, implemented, and regularly reviewed in accordance with policy? This includes:- Enabling logging functionality on security systems (e.g., firewalls, antivirus software). – Backing up and retaining logs for a predefined period. – Reviewing logs for unusual trends, such as repeated malware detections or unusual network activity.(Required)

Yes, all of the above measures are fully implemented.

Some measures are in place, but not all are consistently implemented.

No, these measures are not currently in place.

Not sure.

Detect

This section assesses your organisation’s ability to detect cybersecurity events in a timely manner.

How does your organisation manage the collection and correlation of security event data – to ensure compliance with NIS2? Please select all that apply:(Required)

Logging functionality on protection/detection systems (e.g., firewalls, antivirus) is enabled.

Logs, including network traffic, access attempts, and malware detections, are regularly backed up and saved for a predefined period.

Logs are reviewed for unusual or unwanted trends, such as repeated malware detections or abnormal user activity.

Event data from multiple sources (e.g., network traffic, system logs, audit monitoring, physical access logs, and user/administrator activity reports) is compiled and correlated.

None of the above measures are currently in place.

Not sure.

How does your organisation manage malware protection, including protection against viruses, spyware, and ransomware? Please select all that apply:(Required)

Anti-virus, anti-spyware, and other anti-malware programs are installed on most endpoints, with regular updates applied.

Anti-virus and anti-spyware software are configured to check for updates in real-time or at least daily, followed by system scans.

Malware protection is applied to some personal devices (e.g., BYOD) and home computers used for teleworking, but not consistently.

Endpoints are periodically scanned for malware, though not as frequently as recommended.

Malware protection measures are in development or not fully implemented yet.

Not sure.

Respond

This section evaluates the controls in place to respond effectively to cybersecurity incidents.

Has your organisation established and maintained response and recovery plans for endpoints and broader network systems?(Required)

Yes, response and recovery plans are fully established, regularly reviewed, updated, and tested.

Partially, we have plans in place, but they are not regularly reviewed or tested.

No, we have not established formal response and recovery plans.

Not sure.

How does your organisation ensure that security incidents are properly analysed and categorised to support effective response and recovery? Please select all that apply:(Required)

Notifications from detection systems are investigated promptly to understand the nature of the incident.

The impact of security incidents is thoroughly assessed through detailed analysis, including correlation with risk assessments.

Security incidents are categorised based on severity and impact, in line with the incident response plan.

There are processes in place to receive, analyse, and respond to vulnerabilities disclosed from both internal and external sources (e.g., internal testing, security bulletins, or external researchers).

None of the above measures are currently in place.

Not sure.

How does your organisation manage cybersecurity incidents to prevent escalation, mitigate impact, and resolve them effectively? Please select all that apply:

There are processes in place to contain incidents to prevent further expansion.

Incident mitigation measures are implemented to reduce the effects of cybersecurity incidents on endpoints.

Newly identified vulnerabilities are either mitigated or documented as accepted risks, based on the organisation’s risk assessment.

The incident handling process includes preparation, detection, containment, recovery, and documented risk acceptance.

None of the above measures are currently in place.

Not sure.

Recover

This section assesses the safeguards in place to maintain resilience and restore services following a cybersecurity incident. 

How does your organisation handle security incident reporting? Please select the most appropriate option:(Required)

Incidents are reported immediately via an automated system.

Incidents are manually reported within a defined timeframe.

Incidents are only reported when a significant breach occurs.

No formal incident reporting system is in place.

Not sure.

How does your organisation coordinate restoration activities and manage communication with internal and external stakeholders during recovery from a cybersecurity incident? Please select all that apply:(Required)

Restoration activities are coordinated with internal and external parties, such as Internet Service Providers (ISPs), vendors, and other relevant stakeholders.

Public relations activities are centrally managed, including handling media requests, coordinating interviews, and ensuring communications align with the organisation’s public relations and privacy policies.

Recovery activities are communicated to executive and management teams, as well as predefined internal and external stakeholders.

These measures are partially in place or currently being developed.

None of the above measures are currently in place.

Not sure.

Name(Required)

Email(Required)

Phone(Required)

Solutions

Services

About us

Technologies

Resources

NIS2 Readiness Roadmap

Find your biggest NIS2 gaps in minutes, with clear next steps.

NIS2 Readiness Assessment

Identity

Protect

Detect

Respond

Recover

Microsoft Frontier Tour Utrecht

The mobile visibility blindspot.