Find out where you
stand before the regulator does.
Strategic · Independent · Resilient
NIS2 and DORA both landed with obligations that attach whether or not you have assessed them. A readiness assessment answers the three questions that actually matter: are we in scope, where are the gaps, and what does closing them cost. Fixed scope, defined deliverables, typically three to five weeks.
Regulatory Readiness
NIS2 and DORA readiness assessments with a defensible gap analysis
Scope is where most organisations get this wrong, in both directions. Some assume NIS2 does not apply to them because they are not a utility, when the directive covers digital infrastructure, managed service providers, manufacturing, food, waste and postal services among others. Others over-scope and spend a year on obligations that never applied. DORA has the same problem from a different angle: it reaches ICT third-party providers serving financial entities, not just the entities themselves. We start by determining scope with a documented rationale, then assess your current state against the specific articles that bind you — not a generic checklist — and produce a prioritised remediation plan with effort and cost attached to each gap. The output is designed to survive a conversation with a regulator, an auditor, or a board that wants to know why it should fund the work.
NIS2 Readiness Assessment
Scope determination against Annex I and II sectors and the size thresholds, then assessment against the Article 21 risk management measures and Article 23 incident reporting obligations. Covers governance and management accountability — NIS2 makes management bodies personally liable, which changes who needs to be in the room. Deliverables: scope memorandum with rationale, gap register mapped to specific articles, prioritised remediation roadmap with cost and effort estimates.
DORA Readiness Assessment
Assessment against the five DORA pillars: ICT risk management, incident classification and reporting, digital operational resilience testing, ICT third-party risk, and information sharing. Includes register-of-information readiness — the third-party register is where most entities discover their contract data is incomplete. Deliverables: pillar-by-pillar gap analysis, register-of-information gap report, remediation roadmap sequenced against reporting deadlines.
Scope Determination
A standalone engagement for organisations that genuinely do not know whether a regulation applies. Cheaper and faster than a full assessment, and it is the right first step when the honest answer is "we are not sure". Produces a documented determination you can put in front of a board or a regulator, including the reasoning for entities you concluded were out of scope.
Regulatory Gap Analysis
Where an assessment has already been done — by you or someone else — and you need it validated or converted into an executable plan. We test the findings against the underlying articles, identify what was missed, and turn a list of gaps into sequenced workstreams with owners, dependencies and effort.
Multi-Framework Mapping
Most organisations in scope for NIS2 or DORA also hold ISO 27001, or want to. The control overlap is substantial and mapping it properly avoids paying for the same work twice. We produce a unified control set showing which existing controls satisfy which obligations, and where genuine additional work is required.
Board Briefing
A structured session translating the assessment into what leadership needs to decide: exposure, personal accountability under NIS2, funding required, and the consequences of the timeline slipping. Delivered as a working session rather than a presentation, because the useful output is decisions, not slides.
Regulations and standards covered
Are you in scope, and how far off are you?
If the honest answer is "we think so, but nobody has checked", that is exactly what a readiness assessment is for. A scope determination alone often resolves the question in under two weeks.
Related insights
Further reading
NIS2 vs DORA Obligations for Executive Teams
NIS2 vs DORA obligations require different governance, reporting, and resilience measures. Learn how leaders can build one defensible control program.
InsightsRegulatory Cyber Gap Analysis That Drives Action
A regulatory cyber gap analysis turns obligations into accountable decisions, prioritized remediation, and audit-ready evidence for leaders and boards.
InsightsYour Board-Ready NIS2 Readiness Assessment
A NIS2 readiness assessment gives leaders a clear view of scope, accountability, control gaps, and the actions needed to build defensible resilience now.