A list of NIS2 requirements says little about day-to-day practice. The value of a gap analysis lies in the investigation: which services are critical, who makes decisions, how controls operate and what evidence supports that picture?
Where does a NIS2 gap analysis start?
The first step is to define the organisation and services covered by the assessment. We discuss entity status under the Dutch Cybersecurity Act, critical services, locations, systems, suppliers and the information required by management and the board. This creates a scope that reflects actual risks and responsibilities.
At the outset, we also agree who will provide information and who needs to be interviewed. This may include the board or management team, IT, HR, procurement, privacy, facilities and owners of critical processes. Where IT is outsourced, the relevant supplier is involved in a focused way.
- applicable entities and critical services
- important processes, data and systems
- suppliers and supply-chain dependencies
- internal roles and interview participants
- available documentation and sources of evidence
A useful NIS2 gap analysis gives each important topic a factual status, a substantiated risk, an owner and a realistic next step.
Which areas do we assess?
The precise selection follows from the scope. A full NIS2 gap analysis covers board responsibility and governance, cybersecurity risk-management measures, incident reporting, business continuity, supplier management and demonstrable follow-up.
For each topic, we assess how the elements work together. An incident response procedure may be formally approved while telephone numbers are outdated or an IT supplier is left out of exercises. The document then exists, while its operation still needs attention.
- board responsibility, knowledge and reporting
- risk assessment and risk-treatment decisions
- access management, patching, backups, logging and baseline security
- detection, escalation, reporting deadlines and incident records
- continuity plans, recovery tests and crisis decision-making
- selection, agreements and monitoring of critical suppliers
- training, awareness and demonstrable follow-up of improvements
From policy to evidence from practice
We review relevant documents and discuss with responsible staff how the agreements are applied. Where the assessment requires it, we examine records, configuration data, reports or test results. This provides a view that extends beyond the existence of policies.
An approved decision, a recovery-test report, a current supplier overview or a record of access reviews may already provide valuable clarity. Such evidence shows what the organisation does and how it directs and monitors the work.
- policies, procedures and approved decisions
- risk registers and management reports
- incident, change and access records
- backup and recovery-test results
- contracts, assurance reports and supplier assessments
- training records, exercises and improvement actions
How do we determine the status of a topic?
A simple yes-or-no checklist gives too little direction. We distinguish between areas that are demonstrably in place, areas that are partly operational, missing evidence and topics that still need to be established. We then connect each gap with the related risk, dependencies and feasibility.
Priority follows from risk and context. A missing document may be resolved quickly, while weak recovery capability or unclear ownership may create a greater business risk.
| Status | Meaning |
|---|---|
| Demonstrably in place | The arrangement is clear, is performed and can be supported by appropriate evidence. |
| In development | Part is in place; operation, coverage or evidence still needs work. |
| Gap | A relevant element is missing or does not sufficiently address the risk. |
| Further verification | Information is available, but additional work is needed for a reliable conclusion. |
What does the result contain?
The report contains an executive summary, a gap matrix and an improvement route. For each important point, it records what was assessed, what was found, the associated risk and the appropriate next step.
Actions receive an owner, evidence requirement and place in the plan. Management can then decide which improvements should start immediately, which depend on other projects and which risks are consciously accepted.
- scope and assumptions used
- status for each relevant NIS2 area
- findings and associated risks
- priorities for board, organisation and technology
- actions, owners and required evidence
- roadmap for implementation and later verification
Quick scan, gap analysis, risk assessment or audit?
A NIS2 quick scan provides a compact initial view. A gap analysis investigates the agreed scope through documents, interviews and selected evidence. A risk assessment starts with threats, scenarios, likelihood and impact. An audit systematically tests implemented measures against predefined criteria.
The right choice depends on the question. Organisations looking for an initial view of the main areas for attention can start compactly. A full gap analysis is more suitable for a substantiated improvement programme and board-level decision-making.
Sources and further reading
Based on official requirements and practical implementation
The official sources provide the formal background. Kynexis Informatiebeveiliging BV translates these requirements into a practical approach for organisations subject to NIS2 and the Dutch Cybersecurity Act.
