Skip to content
PL EN
REGULATORY READINESS / NIS2 · DORA

NIS2 and DORA readiness assessment

We translate requirements into controls, owners, evidence and an implementation sequence the team can execute.

We do not sell a binder of policies. Organisational requirements are connected to configuration, process and proof that a control operates. Formal legal interpretation remains with legal or compliance counsel.

Discuss NIS2 / DORA readiness View public work
NIS2 · DORA
Requirements
GAP + EVIDENCE
Assessment
OWNERS
Accountability
30 · 60 · 90
Roadmap
01 / DECISION CONTEXT

When to begin

  • 01When the organisation needs a realistic readiness baseline.
  • 02Ahead of customer, board or supervisory review.
  • 03When policies exist but technical evidence is weak.
  • 04When ICT suppliers and incident processes lack clear ownership.
02 / TEST SURFACE

What we assess

01

Governance and risk

We structure scope, accountability and decision-making.

  • Assets, critical services and risk assessment
  • Board roles, owners and reporting
  • Policies, exceptions and metrics
02

Technical resilience

Controls protecting and restoring operations are validated.

  • Identity, hardening and vulnerabilities
  • Backups, continuity and restoration testing
  • Logging, detection and incident handling
03

Suppliers and evidence

External dependencies and audit material are reviewed.

  • ICT supplier inventory and classification
  • Contractual requirements and exit paths
  • Exercises, tests and evidence packs
03 / DELIVERY

Programme flow

  1. BR / 01

    Scope determination

    We identify entities, services, dependencies and questions requiring legal confirmation.

  2. BR / 02

    Gap assessment

    Documents, configuration, team practice and evidence of control operation are reviewed.

  3. BR / 03

    Validation

    Technical and process controls are sampled, such as restoration, privileged access or incident escalation.

  4. BR / 04

    Remediation programme

    The roadmap includes owners, dependencies, relative effort and closure evidence.

04 / EVIDENCE STANDARD

An incident process exists but fails a timed exercise

GAP MODEL / NO CLIENT DATA

A document is insufficient if the team cannot collect evidence and decide within the required window.

This example is not legal advice and does not describe a client.

E-1

No single owner for incident classification

E-2

Data sources have no agreed retention period

E-3

The notification template has not been exercised

E-4

Remediation includes a tabletop exercise and measurable criteria

05 / OUTPUT

What you receive

01
Requirements, status and evidence matrix
Included deliverable
02
Risk and gap register with owners
Included deliverable
03
30/60/90-day and long-term roadmap
Included deliverable
04
Recommended audit evidence pack
Included deliverable
05
Board presentation and team workshop
Included deliverable
06 / QUESTIONS

Common questions

← All services
01Do you decide whether an organisation falls under NIS2 or DORA?+

We support technical and operational analysis, but formal legal classification should be confirmed by legal or compliance counsel.

02Does the assessment guarantee compliance?+

No. It provides current-state evidence and a plan. Compliance also depends on implementation, sustained operation and the competent authority’s position.

03Can we begin with a short gap analysis?+

Yes. Smaller organisations can start with discovery and prioritisation, then deepen only the highest-impact areas.

BR / NEXT STEP

Need a readiness plan rather than another checklist?

We will agree scope, evidence and the shortest path from current state to operating controls.

Discuss NIS2 / DORA readiness
NDA · clear scope · direct communication