CyberSilo NIS2 Readiness Assessment: What It Covers and What You'll Get

What the CyberSilo NIS2 Readiness Assessment Covers

The assessment addresses all 11 mandatory domains outlined in NIS2 Article 21(2), plus the horizontal governance requirements in Article 20 and the incident reporting obligations in Article 23. Each domain is evaluated against both the Directive’s minimum requirements and the sector-specific expectations published by ENISA and relevant national competent authorities.

Governance and Accountability (Article 20)

NIS2 requires that senior management — not just CISO or IT leadership — formally approve and maintain responsibility for cybersecurity risk management. The assessment examines whether your board or equivalent governing body has documented cybersecurity oversight, whether management receives regular risk reporting, and whether liability clauses align with the increased personal accountability provisions in Article 20(2). Organisations operating in sectors such as energy, digital infrastructure, or public administration will need to demonstrate that cybersecurity is integrated into corporate governance frameworks at the highest level.

Technical Risk Management Controls (Article 21(2))

This is the core technical evaluation. The assessment covers the full set of Article 21(2)(a) through (j) requirements, including:

• Policies on risk analysis and information system security
• Incident handling procedures aligned with Article 23 reporting timelines
• Business continuity and crisis management including backup restoration testing
• Supply chain security controls for direct suppliers and service providers
• Network and information system acquisition, development, and maintenance security
• Vulnerability disclosure and handling procedures
• Cryptography and encryption policies for data in transit and at rest
• Staff security, access control, and asset management
• Multi-factor authentication and continuous authentication across critical systems
• Use of secure voice, video, and text communications for incident response

Each sub-domain is rated against the NIS2 proportionality principle, meaning the assessment adjusts its stringency based on your organisation’s size, sector criticality, and the level of risk your operations present to the broader European economy.

Incident Reporting and Notification (Article 23)

The assessment evaluates your incident detection and classification capabilities against the mandatory notification timeline: initial alert within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final report within one month. We assess whether your SOC or managed detection and response function can reliably classify incidents as “significant” using the Article 23 criteria including the number of affected users, the duration of the incident, and the potential for economic or societal disruption.

Supply Chain and Third-Party Risk (Article 24)

NIS2 explicitly extends liability to supply chain partners for essential and important entities. The assessment reviews your vendor risk management programme, including whether you require NIS2 compliance from critical subcontractors, whether you conduct pre-contractual security assessments, and whether your service level agreements include incident notification flows that match the Article 23 deadlines.

Documentation and Evidence Readiness

A significant portion of the assessment focuses on whether your controls are not just implemented but adequately documented. NIS2 empowers national competent authorities to conduct proactive audits and request evidence of compliance — without appropriate documentation, even strong technical controls may be deemed non-compliant during an audit.

The Assessment Methodology and Risk Scoring Framework

CyberSilo uses a four-phase methodology aligned to ENISA’s NIS2 implementation guidance and ISO/IEC 27001:2022 audit protocols:

What You Get: The Assessment Deliverables

At the conclusion of a CyberSilo NIS2 Readiness Assessment, your organisation receives a comprehensive package designed for both operational remediation and audit defence:

The evidence repository is particularly important — national competent authorities across the EU are increasingly requesting structured evidence packages during proactive compliance checks under Article 31. CyberSilo’s assessment platforms ensure that every control finding is backed by auditable documentation.

How the Assessment Supports Ongoing Compliance

NIS2 compliance is not a one-time event — Article 21(4) requires organisations to regularly review and update their risk management measures. The CyberSilo assessment serves as baseline for annual or bi-annual reassessments, and the evidence repository can be incrementally updated as controls mature.

For organisations pursuing broader compliance programmes, the same evidence base supports ISO/IEC 27001:2022 certification (particularly Annex A controls 5.1–5.36 on organisational controls), GDPR Article 32 technical and organisational measures, and DORA compliance for financial sector entities. CyberSilo’s EU cybersecurity compliance services provide a unified assessment framework that reduces duplication of effort across multiple regulatory regimes.

Common Pitfalls the Assessment Reveals

In our experience conducting assessments across European essential and important entities, several recurring gaps emerge that organisations frequently overlook:

Board-level accountability documentation. Many organisations have strong operational security but lack formal board minutes, risk register sign-offs, or management reviews that demonstrate the governance required by Article 20. This is the single most common finding in initial assessments.

Supply chain coverage gaps. Even organisations with mature internal controls often fail to extend NIS2-equivalent requirements to their critical suppliers. Article 24 explicitly requires you to address supply chain security for direct service providers — a gap that can result in full non-compliance even if your internal controls are strong.

Incident classification training. The 24-hour notification window requires security teams to make rapid classification decisions under Article 23(3) criteria. Without trained analysts and clear triage playbooks, organisations risk missing notification deadlines or over-reporting (which creates its own regulatory exposure).

Cryptography policy updates. Many legacy policies still reference outdated cryptographic standards. Article 21(2)(g) requires “state-of-the-art” cryptography — the assessment evaluates whether your policies reference current standards such as TLS 1.3, post-quantum readiness planning, and the EU’s upcoming encryption regulations.

Sector-Specific Considerations

The NIS2 assessment is tailored to the sector-specific requirements published by ENISA and national authorities. For example:

• Energy sector: Additional scrutiny on OT/ICS network segmentation and supply chain security for smart grid components
• Healthcare: Specific assessment of patient data availability and the overlap between NIS2 incident reporting and GDPR Article 33 breach notification
• Digital infrastructure: Evaluation of DNS, cloud computing, and data centre service resilience against Article 23 notification thresholds
• Public administration: Assessment of eIDAS 2.0 digital identity requirements and cross-border service continuity planning

CyberSilo’s assessment templates include sector-specific control questions and risk weighting to ensure the final score reflects your actual regulatory exposure.

Self-Assessment vs. Third-Party Assessment

While NIS2 allows for internal self-assessments under certain conditions, a third-party assessment from a provider like CyberSilo offers several advantages. The independent perspective often identifies blind spots that internal teams miss, the evidence repository is structured to meet audit expectations of national competent authorities, and the executive summary carries greater weight with boards and regulators — particularly for organisations that have experienced prior incidents or operate in sectors under heightened authority scrutiny.