NIS2 readiness check.
Two scopes — pick one inside the tool. Supply chain (default · 20 questions, ~5 min) covers governance, supplier risk, incident response, and evidence under a supply-chain emphasis. Full NIS2 (35 questions, ~8-10 min) covers all ten Article 21(2) clauses with dedicated categories for acquisition / development / vulnerability handling, cryptography, and cyber hygiene / access / secure communications. Three-point scale per question, article-anchored gap report at the end.
Honest framing: this is a directional steer, not a substitute for a formal assessment. We'll tell you the same thing in your results. Sister to the supplier-side Supplier readiness check.
Two scopes available: Supply chain (default — twenty questions, supplier-risk emphasis) or Full NIS2 (thirty-five questions, adds Article 21(2)(e) acquisition / development / vulnerability handling, 21(2)(h) cryptography, and 21(2)(g)/(i)/(j) cyber hygiene, access and secure communications). Three answers per question. Your inputs stay in your browser; if you'd like an email summary at the end, you opt in then. Everything is anchored to a specific NIS2 article so you can verify the framing.
Governance & risk management
Whether your organisation treats cybersecurity as an operational risk owned at executive level, or a checkbox owned by IT.
Do you have a documented information security risk management policy approved by the management body?
Article 21(2)(a)Has the management body received cybersecurity training in the last 12 months?
Article 20Is there a defined risk owner for cybersecurity at executive level (named individual, not a department)?
Article 20Are cybersecurity risks reviewed regularly (e.g., quarterly) with the board, with documented minutes?
Article 21(2)(a)Is your risk register linked to specific operational and supplier risks — not just abstract categories like "cyber attack"?
Article 21(2)(a)All 35 questions
Every question in the check, by area, with the NIS2 article each one maps to. The Supply chain scope asks the first four areas, 20 questions; Full NIS2 adds the last three.
01 Governance & risk management
- Do you have a documented information security risk management policy approved by the management body?Article 21(2)(a)
- Has the management body received cybersecurity training in the last 12 months?Article 20
- Is there a defined risk owner for cybersecurity at executive level (named individual, not a department)?Article 20
- Are cybersecurity risks reviewed regularly (e.g., quarterly) with the board, with documented minutes?Article 21(2)(a)
- Is your risk register linked to specific operational and supplier risks — not just abstract categories like "cyber attack"?Article 21(2)(a)
02 Supplier risk management
- Do you maintain a current inventory of suppliers handling regulated services or sensitive data?Article 21(2)(d)
- Have you risk-tiered your suppliers by criticality (e.g. Tier 1 / 2 / 3, or High / Medium / Low)?Article 21(2)(d)
- Do you collect documented evidence of suppliers’ security posture (certificates, attestations, contract clauses)?Article 21(2)(d)
- Do you reassess suppliers on a defined cadence (annually) AND on material change (incident, M&A, scope shift)?Article 21(2)(d)
- Can you reconstruct, for any supplier, who reviewed what evidence, when, and what they decided?Article 21(2)(d), 23
03 Incident response & continuity
- Do you have a documented incident response plan that’s been tested in the last 12 months?Article 21(2)(b)
- Do you have backup and disaster recovery procedures that have been tested regularly (this check uses six months as its bar for critical systems)?Article 21(2)(c)
- Are your suppliers contractually required to notify you of incidents affecting your services within a defined window (e.g. 72 hours)?Article 21(2)(d), 23
- Do you have a process to assess supply-chain incidents within 24 hours of becoming aware?Article 23
- Does your business continuity plan cover supplier failure scenarios — not just internal outages?Article 21(2)(c)
04 Evidence & audit-readiness
- Could you produce, on request, a complete audit trail of how a specific supplier was assessed (questions asked, evidence reviewed, decisions taken)?Article 21(2)(d), 21(2)(f)
- Are your security policies version-controlled with documented review dates and approval records?Article 21(2)(a)
- Do you have a documented process for assessing the effectiveness of your cybersecurity measures (not just their existence)?Article 21(2)(f)
- Could you respond to a formal regulator inquiry about your supply chain controls within 5 business days?Article 32
- Are cybersecurity training records, MFA enrolment, and access reviews maintained as evidence — not just as activities?Article 21(2)(g), (i), (j)
05 Acquisition, development & vulnerability handlingFull NIS2 only
- Do you have documented security requirements that are applied to ALL new technology acquisitions (software, services, hardware) — not just procurement boilerplate but enforceable controls?Article 21(2)(e)
- Do you have a documented secure development lifecycle (SDLC) — including code review, security testing, and threat modelling — applied to systems you build or substantially customise?Article 21(2)(e)
- Do you run vulnerability scans on a defined cadence (this check uses monthly as its bar) with severity-based remediation SLAs (e.g. critical = 7 days, high = 30 days)?Article 21(2)(e)
- Is there a documented patching policy — including emergency-patch handling for critical CVEs — that applies to ALL in-scope systems with a defined accountability chain?Article 21(2)(e)
- Do you have a coordinated vulnerability disclosure (CVD) policy — a structured channel for external researchers to report security issues to you safely?Article 21(2)(e)
06 CryptographyFull NIS2 only
- Do you have a documented cryptography policy that names approved algorithms, key lengths, and protocol minimums (e.g. TLS 1.2+, AES-256)?Article 21(2)(h)
- Is data at rest encrypted across ALL systems holding regulated or sensitive data (databases, backups, file storage, removable media)?Article 21(2)(h)
- Is data in transit encrypted across ALL channels (internal AND external), with named protocol minimums (e.g. TLS 1.2+ enforced, deprecated ciphers disabled)?Article 21(2)(h)
- Do you have a documented key management process — generation, secure storage (HSM or equivalent), rotation cadence, and revocation?Article 21(2)(h)
- Are cryptographic configurations reviewed at least annually against current standards (ENISA / NIST recommendations, deprecated-algorithm timelines)?Article 21(2)(h)
07 Cyber hygiene, access & secure communicationsFull NIS2 only
- Do you have a documented cyber hygiene programme — phishing simulation on a defined cadence, password policy aligned to NIST/ENISA guidance, removable-media policy — alongside the annual cybersecurity training?Article 21(2)(g)
- Is there a documented access control policy — role-based access (RBAC) and least-privilege as the default — applied to ALL systems with sensitive data, including admin and break-glass paths?Article 21(2)(i)
- Do you maintain a current asset inventory (software, hardware, services, data) with named owners and a defined classification, reviewed at least annually?Article 21(2)(i)
- Do you have HR security controls — background checks for sensitive roles, NDAs, AND a documented off-boarding procedure that revokes access within 24 hours of departure?Article 21(2)(i)
- Have you designated secure channels (encrypted voice, video, text, emergency communications) for sensitive operational and incident-response communications — and is staff trained on when to use them?Article 21(2)(j)