NIS2 Gap Assessment Template

Suggested Template Columns

Workshop Agenda (Half Day)

1. Confirm essential vs important classification hypotheses
2. Walk all 10 Article 21 categories
3. Tabletop a significant incident against 24h / 72h / one-month clocks
4. Prioritise remediation by supervisory exposure

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is a gap assessment the same as certification?

No. NIS2 is supervisory compliance, not an ISO-style certificate. A gap assessment prepares evidence for authorities and customers.

How often should we refresh it?

At least annually, after major architecture changes, and after significant incidents.

Can ISO 27001 SoA replace this template?

Use SoA as an input, then add explicit NIS2 rows for Article 20/23 and any uncovered Article 21 themes.

Related NIS2 Resources

NIS2 hub · Article 21 · CSA