NIS2 Readiness Assessment

Are You NIS2 Ready?

Take the Free Self Assessment

This short survey is designed to help you evaluate how well your devices align with NIS2 requirements. By assessing key areas such as access control, patch management, and data protection, we can help identify potential gaps and highlight opportunities for improvement.

Once you complete the survey, you’ll receive a tailored report with actionable recommendations specific to your organisation’s needs. To further support you, one of our NIS2 experts will provide a free follow-up consultation, offering insights and guidance on implementing these recommendations effectively.

Take the survey today to ensure your devices meet NIS2 compliance standards and are equipped to navigate the ever-evolving cybersecurity landscape.

NIS2 Readiness Assessment

Company Name(Required)

Job Title(Required)

Number of Employees(Required)

Location(Required)

Identity

This section assesses your organisation’s ability to identify and understand cybersecurity risks related to its systems, users, data, and capabilities.

Are your organisation’s assets covered by information and cybersecurity policies, ensuring these policies are documented, reviewed, and updated when necessary?(Required)

Yes, all assets are fully covered by our information and cybersecurity policies.

Partially, not all assets are included in our information and cybersecurity policies.

Partially, some aspects of our policies are incomplete or not reviewed regularly.

No, there is no policy in place.

Not sure.

Does your organisation have a process to monitor, identify, and document vulnerabilities and weaknesses across its endpoints?(Required)

Yes, we have a formal process that covers all these areas.

Partially, but some areas are not consistently monitored or documented.

No, we do not have a formal process for managing vulnerabilities in our endpoints.

Not sure.

Has your organisation clearly defined its risk tolerance for all its endpoints, particularly in the context of NIS2?(Required)

Yes, our risk tolerance is clearly defined for all endpoints.

Partially, we have a defined risk tolerance for some endpoints.

We are currently in the process of defining it.

No, we have not defined a risk tolerance for our endpoints.

Not sure.

Protect

This section evaluates the safeguards in place to mitigate or contain cyber risks.

Are your endpoints enrolled in a Unified Endpoint Management (UEM) solution and managed according to your security policies?(Required)

Yes, all endpoints are fully enrolled in a UEM solution and managed in compliance with our organisation’s security policies.

Yes, but only some endpoints are enrolled in the UEM solution and managed according to our security policies.

No, but we are planning to enroll our endpoints in a UEM solution.

No, our endpoints are not enrolled in a UEM solution and are not currently managed according to security policies.

Not sure.

How is access control managed to safeguard critical network systems? Please select all that apply.(Required)

Multi-factor authentication (MFA) for all users.

Access based on user roles, following least privilege principles.

A centralised identity and access management (IAM) system.

Local accounts with strong password policies.

Biometric authentication (e.g., fingerprint or facial recognition).

There is no formal access control policy in place.

Not sure.

Are all end users required to use a VPN when accessing the organisation’s critical systems remotely?(Required)

Yes, all users must use a VPN for remote access on public Wi-Fi.

Some users use a VPN, but it’s not mandatory for everyone.

No, users are not required to use a VPN.

Not sure.

How is network traffic monitored for potential security incidents?(Required)

Is your organisation using an identity and access management (IAM) solution to manage access permissions and authorisations, ensuring that the principles of least privilege and separation of duties are applied?(Required)

Yes, we use an IAM solution and fully implement least privilege and separation of duties.

Yes, we use an IAM solution, but least privilege and separation of duties are only partially implemented.

No, we do not use an IAM solution, but we manage permissions manually.

No, we do not have a formal process for managing access permissions and authorisations.

Not sure.

Do you have firewall configurations in place to limit network access?(Required)

Yes, firewalls are configured with strict access rules.

es, firewalls are enabled but with default settings.

Firewalls are only used on certain endpoints.

No, there are no firewall configurations in place.

Not sure.

Is there a policy in place that requires the use of encryption for both data-at-rest and data-in-transit?(Required)

Yes, we have a comprehensive encryption policy for both data-at-rest and data-in-transit.

Yes, but it only covers either data-at-rest or data-in-transit, not both.

No, but we are planning to implement an encryption policy.

No, we do not have an encryption policy in place.

Not sure.

What actions is your organisation taking to prevent data leaks? Please select all that apply:(Required)

Has your organisation developed, documented, and maintained a baseline configuration for its endpoints, incorporating key security principles such as least functionality?(Required)

Yes, we have a comprehensive baseline configuration for all endpoints, including current version numbers, patch information, configuration settings, and network topology.

Yes, but the baseline configuration is only partially documented for some endpoints.

No, but we are planning to implement and document a baseline configuration for our endpoints.

Not sure.

Do you have patch management in place to ensure your endpoints and applications are consistently updated to the latest versions?(Required)

Yes, automated patch management is fully in place for both endpoints and applications.

Patch management is in place, but some endpoints or applications are updated manually.

Patches are applied manually for both endpoints and applications.

No patch management system is currently in place.

Not sure.

How quickly do you apply critical security patches after they are released?(Required)

Within 24 hours or release.

Within 1 week of release.

Within 1 month of release.

Patches are applied irregularly with no set timeframe.

Not sure.

Do you use a custom Software Update Server to control which updates are approved and deployed?(Required)

Yes, we use a custom Software Update Server to whitelist and manage approved updates.

Some updates are managed through a custom server, but not all.

Updates are approved manually without a custom server.

No custom Software Update Server is in place.

Not sure.

Do you use a tool to monitor operating system upgrades in real-time, ensuring your endpoints are always running the latest and most secure version?(Required)

Yes, real-time monitoring is in place for the entire fleet.

Monitoring is in place, but it’s not real-time or comprehensive.

Monitoring is done manually or periodically.

No monitoring tool is in place for operating system updates.

Not sure.

Do you have a rollback or recovery procedure in place in case an update causes issues?(Required)

Yes, we have a robust rollback plan for any failed updates.

Rollback options are available but not always reliable.

Rollback options are limited or difficult to implement.

There is no rollback or recovery plan in place for update failures.

Not sure.

Does your organisation have a process in place for managing audit/log records, ensuring they are determined, documented, implemented, and regularly reviewed in accordance with policy? This includes:- Enabling logging functionality on security systems (e.g., firewalls, antivirus software). – Backing up and retaining logs for a predefined period. – Reviewing logs for unusual trends, such as repeated malware detections or unusual network activity.(Required)

Yes, all of the above measures are fully implemented.

Some measures are in place, but not all are consistently implemented.

No, these measures are not currently in place.

Not sure.

Detect

This section assesses your organisation’s ability to detect cybersecurity events in a timely manner.

How does your organisation manage the collection and correlation of security event data – to ensure compliance with NIS2? Please select all that apply:(Required)

Logging functionality on protection/detection systems (e.g., firewalls, antivirus) is enabled.

Logs, including network traffic, access attempts, and malware detections, are regularly backed up and saved for a predefined period.

Logs are reviewed for unusual or unwanted trends, such as repeated malware detections or abnormal user activity.

Event data from multiple sources (e.g., network traffic, system logs, audit monitoring, physical access logs, and user/administrator activity reports) is compiled and correlated.

None of the above measures are currently in place.

Not sure.

How does your organisation manage malware protection, including protection against viruses, spyware, and ransomware? Please select all that apply:(Required)

Anti-virus, anti-spyware, and other anti-malware programs are installed on most endpoints, with regular updates applied. .

Anti-virus and anti-spyware software are configured to check for updates in real-time or at least daily, followed by system scans.

Malware protection is applied to some personal devices (e.g., BYOD) and home computers used for teleworking, but not consistently.

Endpoints are periodically scanned for malware, though not as frequently as recommended.

Malware protection measures are in development or not fully implemented yet.

Not sure.

Respond

This section evaluates the controls in place to respond effectively to cybersecurity incidents.

Has your organisation established and maintained response and recovery plans for endpoints and broader network systems?(Required)

Yes, response and recovery plans are fully established, regularly reviewed, updated, and tested.

Partially, we have plans in place, but they are not regularly reviewed or tested.

No, we have not established formal response and recovery plans.

Not sure.

How does your organisation ensure that security incidents are properly analysed and categorised to support effective response and recovery? Please select all that apply:(Required)

Notifications from detection systems are investigated promptly to understand the nature of the incident.

The impact of security incidents is thoroughly assessed through detailed analysis, including correlation with risk assessments.

Security incidents are categorised based on severity and impact, in line with the incident response plan.

There are processes in place to receive, analyse, and respond to vulnerabilities disclosed from both internal and external sources (e.g., internal testing, security bulletins, or external researchers).

None of the above measures are currently in place.

Not sure.

How does your organisation manage cybersecurity incidents to prevent escalation, mitigate impact, and resolve them effectively? Please select all that apply:

There are processes in place to contain incidents to prevent further expansion.

Incident mitigation measures are implemented to reduce the effects of cybersecurity incidents on endpoints.

Newly identified vulnerabilities are either mitigated or documented as accepted risks, based on the organisation’s risk assessment.

The incident handling process includes preparation, detection, containment, recovery, and documented risk acceptance.

None of the above measures are currently in place.

Not sure.

Recover

This section assesses the safeguards in place to maintain resilience and restore services following a cybersecurity incident. 

How does your organisation handle security incident reporting? Please select the most appropriate option:(Required)

Incidents are reported immediately via an automated system.

Incidents are manually reported within a defined timeframe.

Incidents are only reported when a significant breach occurs.

No formal incident reporting system is in place.

Not sure.

How does your organisation coordinate restoration activities and manage communication with internal and external stakeholders during recovery from a cybersecurity incident? Please select all that apply:(Required)

Restoration activities are coordinated with internal and external parties, such as Internet Service Providers (ISPs), vendors, and other relevant stakeholders.

Public relations activities are centrally managed, including handling media requests, coordinating interviews, and ensuring communications align with the organisation’s public relations and privacy policies.

Recovery activities are communicated to executive and management teams, as well as predefined internal and external stakeholders.

These measures are partially in place or currently being developed.

None of the above measures are currently in place.

Not sure.

Name(Required)

Email(Required)

Phone(Required)

Name

This field is for validation purposes and should be left unchanged.

Cookie	Duration	Description
__hssrc	session	This cookie is set by Hubspot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session.
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent	1 year	Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
__cf_bm	30 minutes	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
__hssc	30 minutes	HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie.
bcookie	2 years	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser ID.
bscookie	2 years	LinkedIn sets this cookie to store performed actions on the website.
lang	session	LinkedIn sets this cookie to remember a user's language setting.
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
UserMatchHistory	1 month	LinkedIn sets this cookie for LinkedIn Ads ID syncing.

Cookie	Duration	Description
__hstc	5 months 27 days	This is the main cookie set by Hubspot, for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gat_gtag_UA_118644892_1	1 minute	Set by Google to distinguish users.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
CONSENT	2 years	YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data.
hubspotutk	5 months 27 days	HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts.

Cookie	Duration	Description
VISITOR_INFO1_LIVE	5 months 27 days	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
YSC	session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt-remote-device-id	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt.innertube::nextId	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.
yt.innertube::requests	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.

Cookie	Duration	Description
AnalyticsSyncHistory	1 month	No description
li_gc	2 years	No description