NIS2 gap analysis: preparing for the new cyber law

Starting October 2024, many organizations will have to comply with a new European cybersecurity law: The NIS2 Directive. NIS2 is an extension of previous regulations and sets clear requirements for the digital security of organizations in Europe. This includes companies and institutions that are indispensable to our society, such as energy companies, hospitals, and drinking water suppliers.

Even smaller companies will have to deal with NIS2. Do you have more than 50 employees or is your revenue over 10 million euros? Then these rules will likely apply to you as well. Even if your company is smaller, but provides services that are essential for other organizations, you will have to comply with this directive.

The NIS2 rules go beyond just your own organization. This is because suppliers must also comply with the same cybersecurity requirements. For example, a municipality will soon only be able to work with companies that are digitally secure. In this way, NIS2 ensures that the entire chain becomes more secure.

Key obligations under NIS2

NIS2 brings clear obligations for organizations. These are three:

• Register Officially register your organization with the government's cyber reporting center. This will let the government know exactly which organizations fall under these rules.
• Properly arranging cybersecurity: Specific measures such as incident management plans, secure backups, and regular risk analyses.
• Report incidents quickly: For major digital incidents, submit an initial report within 24 hours and a full report within 72 hours.

De gevolgen van niet voldoen aan deze regels zijn stevig. Organisaties riskeren boetes tot 10 miljoen euro of 2% van de jaarlijkse omzet. Bestuurders kunnen zelfs persoonlijk aansprakelijk gesteld worden.

Why start with a NIS2 gap analysis already?

NIS2 is already in the European Official Journal; in the Netherlands, the law will probably not be actively enforced until 2026. Those who wait until that moment run the risk of working nights and expensive last-minute jobs. An early gap analysis works like a snapshot of your digital household: clear, sharp, and on time.

A gap analysis offers several advantages:

• Take the lead – You see where you fall short early and can spread improvements over multiple quarters.
• Administrative tranquility – A well-substantiated report shows management and supervisory bodies that cyber risks are under control.
• Targeted investments – Budgets go to the places where the chance of disruption is greatest, rather than to “everything at once.”.

Whoever starts now won't fall behind later, but will maintain a healthy routine.

Step-by-step guide: conducting your own NIS2 gap analysis

1. Determine scope

First, determine if your organization falls into the “essential” or “important” entity category. Consider not only your own legal entity but also business units and critical suppliers. This scoping will prevent project creep.

Mapping NIS2 requirements

List all requirements from Article 21, such as risk assessment, incident response, backups, supply chain management, secure development, and access security. This list serves as the benchmark against which you will later compare your own organization.

3. Inventory current measures

Gather policy documents, procedures, and technical controls. Consider ISMS documentation, logging systems, pentest reports, and training records. The more complete this baseline measurement, the better you will be able to identify gaps later.

4. Identify Gaps

Explain the Step 2 benchmark next to your inventory. Note where measures are missing, not current, or insufficiently demonstrated. Consider this already in your calculations evidenceWhich log files, reports, or dashboards can you show later?

5. Prioritize Risks

Not every gap needs to be closed tomorrow. Therefore, link each gap to a probability and consequence for business processes. Gaps that can cause direct disruptions or are reportable deserve the top spot on your list.

6. Develop an action plan

Translate the priorities into concrete tasks: what needs to be done, who is responsible, and what is the deadline? Quick wins – such as formalizing existing policy – can be implemented in the next sprint; larger projects like network segmentation will have a realistic timeframe.

7. Borrowing and repeat

Plan a fixed feedback loop, for example, quarterly in the security committee. This way, the yardstick remains relevant, maturity grows, and management will always see an up-to-date progress report. An annual re-analysis keeps the process sharp and aligns with the internal audit cycle.

Tips for a successful gap analysis

A NIS2 gap analysis asks Accuracy and collaboration. Therefore, keep the following in mind:

• Put the steering wheel in the boardroom – Involve the board early so that decisions about time, budget, and risks land correctly from the outset.
• Work multidisciplinary IT security, operations, legal affairs, and internal audit all view the same risks slightly differently; together, you see more than you would alone.
• Proof in black and white – Collect documents, log files, and reports while you analyze. Without evidence, an audit remains “undemonstrable.”.
• Use recognized frameworks – Standards such as ISO 27001 or CIS Controls align logically with NIS2 articles; this makes comparison easier.

With a clear process and these rules of thumb, you'll avoid blind spots and keep the analysis manageable.

Outsource NIS2 gap analysis or do it yourself?

Many organizations start by using their own people. This makes sense: internal knowledge and short communication lines speed up the start. Nevertheless, external support can add value, especially when it comes to scale and depth. External specialists bring comparative material from previous projects, which speeds up the interpretation of findings.

In addition, external support offers independence. Towards regulators, an external party reduces discussions about ‘the butcher and his own meat.’.

A hybrid approach often works best:

• The internal team is conducting the baseline measurement.
• An external expert will review the findings and help refine the action plan.

This way, you keep knowledge in-house and benefit from fresh perspectives.

When you're ready to take the next step, our specialists are available to validate your analysis or explore it further together.