NIS2 audit — Readiness Check and gap analysis
Before you spend €23,000 on a full NIS2 implementation, check where you stand. NIS2 Readiness Check is a quick assessment: legal verification (do you fall under NIS2?), current state vs requirements gap analysis, and a concrete action roadmap. Clear answers without breaking the bank.
Describe your scope — your account manager will reply within 24 hours.
- From €3,500 net
- Delivery: 2 weeks
- Free quote
What is the NIS2 audit (NIS2 Readiness Check)?
The nFlo NIS2 audit comes in two levels; the first, NIS2 Readiness Check, is a rapid 2-week assessment that answers two critical questions before you commit to a costly full NIS2 implementation: does your organization legally fall under the directive (Essential Entity, Important Entity, or out of scope), and if so, where are your specific gaps across the 10 NIS2 requirement areas? nFlo delivers a gap analysis report, an executive summary for the board, a prioritized implementation roadmap, and a cost estimate — so you invest in what is actually needed rather than a blanket €23,000+ project. This diagnostic investment, from €3,500 net, regularly saves organizations from unnecessary spending or from being caught unprepared for fines up to €10 million.
Where to start with NIS2?
Answer a few short questions — we will point you to the service worth starting with and fill in the description in the contact form for you.
The qualifier requires JavaScript. If it does not appear, write to us via the contact page. Go to contact
Who is asking?
Which sector does the organisation operate in?
The list of sectors comes from the annexes to the NIS2 Directive, which Poland implements through an amendment to the Polish KSC Act (Act on the National Cybersecurity System).
How many people does the organisation employ?
Size is determined by the number of employees and the annual turnover or balance sheet total.
How far along are your preparations?
What do you need?
Our recommendation
Based on your answers, we suggest starting with:
NIS2 audit — Readiness Check and gap analysis
This service — you are on its page- This is a preliminary orientation, not a legal opinion.
- To get in touch, we need your e-mail address; a phone number is optional.
We filled in the description in the form based on your answers — you can change it before sending.
We could not fill in the form automatically. Please write to us via the contact page. Go to contact
What next?
Our NIS2 services are aimed at companies and institutions. These materials will help you get to know the regulations.
Thank you for your interest in working at nFlo. You can learn more about us on our About page.
We accept partnership proposals through the contact form.
Before we talk, it is worth checking whether the regulations cover your organisation.
- As a rule, the NIS2 rules cover companies from medium-sized enterprises upwards.
- Some entities are covered by the NIS2 rules regardless of their size.
- Entities covered by the rules must ensure supply chain security, including in their relationships with direct suppliers.
Contact your account manager
Discuss NIS2 audit — Readiness Check and gap analysis with your dedicated account manager.
Don't know if NIS2 applies to you - and fines are up to EUR 10M
Clear answer in 2 weeks - without spending a fortune
Legal status
Do you fall under NIS2? Essential or Important?
Gap Analysis
Where you are vs where you need to be
Roadmap
What to do, in what order
The NIS2 audit in two levels
You can order the nFlo NIS2 audit at one of two levels — depending on whether you already know the rules apply to you.
| NIS2 Readiness Check (initial assessment) | NIS2/KSC audit (gap analysis) | |
|---|---|---|
| Question it answers | Does NIS2 apply to us and how much will implementation cost? | Which NIS2 and KSC Act requirements do we not meet? |
| Scope | Legal qualification, 1-day discovery session, maturity scoring (1-5) across 10 NIS2 areas | Entity classification and gap analysis of the 10 requirement areas based on evidence and interviews, including risk management, incident reporting and supply chain |
| Deliverable | Report (20-30 pages), executive summary, roadmap, implementation cost estimate | Gap report with a compliance implementation plan and timeline |
| Who it is for | You don’t know whether NIS2 applies to you and the board wants a business case before the budget decision | You know you are an essential or important entity and need a formal gap report |
| Time | 2 weeks (Enterprise: 3-4 weeks) | 7-12 business days |
| Price (net) | from €3,500 (Enterprise: individual quote after scoping) | from €6,000 (BASIC package: €6,000–€10,500) |
Both levels end with a report and a results discussion. If after the audit you want to go all the way to compliance, the next step is NIS2 implementation — its price already includes the gap analysis.
The NIS2 audit and the KSC Act — legal basis
In Poland, the NIS2 Directive is implemented by the Act of 23 January 2026 amending the Act on the National Cybersecurity System (Journal of Laws 2026 item 252), in force since 3 April 2026. An essential or important entity has 12 months from meeting the conditions to fulfil the obligations of Chapter 3 of the Act, and an essential entity must also carry out, at its own cost, a security audit of its information system at least once every 3 years (Art. 15(1)) — for the first time within 24 months (Art. 16). The Readiness Check and gap analysis do not replace that audit — they show the gaps to close before it.
”I don’t know if NIS2 applies to us - and I’m afraid to ask”
IT Director of a mid-sized manufacturing company: “I hear about NIS2 from everywhere. EUR 10 million fines. But when I ask lawyers, they say ‘it depends.’ When I ask consultants, they propose a €34,500 implementation. And I don’t even know if we fall under this regulation. 18 sectors, size thresholds, essential vs important… I need a simple answer, not a six-month project.”
Typical problems before NIS2 Readiness Check:
- You don’t know if your company falls under NIS2 (18 sectors, various thresholds)
- You’re afraid the consultant will “invent” problems to sell a bigger project
- You don’t want to spend €23k+ on implementation before knowing actual scope
- Board asks “how much will it cost?” - and you have no answer
- Deadline is approaching, and you’re still in “research” mode
Clear diagnosis in 2 weeks - no commitments
NIS2 Readiness Check is a quick initial assessment. We’re not selling you an implementation - we’re selling knowledge about whether you need one and to what extent. After 2 weeks you know exactly: (1) do you fall under NIS2, (2) where are your gaps, (3) how long and how much will it cost to close them.
What you get:
- Legal verification of NIS2 status (Essential/Important/Not in scope)
- Current security state assessment vs 10 NIS2 requirement areas
- Gap analysis - specific gaps with criticality rating
- Implementation roadmap with priorities and dependencies
- Implementation cost estimate (scope and costs)
- Executive summary for the board (1 page, no jargon)
- Results discussion session with recommendations
Who is this for?
NIS2 Readiness Check is for you if:
- You don’t know if your company falls under NIS2
- You want to know the scope of work before committing to a big project
- Board requires a business case and estimate before budget decision
- You already have “something done” (ISO 27001, policies) and want to know how much is missing
- You’d rather spend €3.5k on diagnosis than €34.5k on a “maybe needed” implementation
How the NIS2 audit works
The NIS2 audit consists of six named steps — in the Readiness Check spread over 2 weeks:
- Legal verification (days 1-2) — sector, size and revenue; status: essential entity, important entity or not in scope.
- Discovery session (days 3-5) — one day of interviews with IT, security and management, on-site or remote.
- Documentation and systems review — existing policies and procedures, critical systems walkthrough.
- Gap analysis (days 6-8) — assessment of the 10 NIS2 requirement areas, maturity scoring (1-5), quick wins and critical gaps, mapping to existing controls (ISO 27001, other frameworks).
- Report and roadmap (days 9-10) — gap analysis report, executive summary for the board, prioritized roadmap, implementation cost estimate.
- Results discussion session (2 hours) — recommendations and next steps.
In the NIS2/KSC audit (gap analysis), step 4 is based on evidence and interviews and includes entity classification, and step 5 ends with a gap report with a compliance implementation plan and timeline — the whole audit takes 7-12 business days.
Week 1: Qualification and Discovery
Day 1-2: Legal verification
- Company profile analysis (sector, size, revenue)
- Assessment if company meets NIS2 criteria
- Status determination: Essential Entity / Important Entity / Not in scope
- If not in scope - you get a report and save on implementation
Day 3-5: Discovery session (1 day on-site or remote)
- Interview with IT (infrastructure, security, backup)
- Interview with management (risk appetite, business priorities)
- Review of existing documentation (policies, procedures)
- Critical systems walkthrough
Week 2: Analysis and Report
Day 6-8: Gap Analysis
- Assessment vs 10 NIS2 requirement areas
- Maturity scoring (1-5) for each area
- Quick wins and critical gaps identification
- Mapping to existing controls (ISO 27001, other frameworks)
Day 9-10: Report and Roadmap
- Gap Analysis report (20-30 pages)
- Executive Summary (1 page for board)
- Implementation roadmap (Gantt with priorities)
- Estimated implementation costs
- Results discussion session (2h)
What’s in the Report?
1. NIS2 Legal Status
| Element | Result |
|---|---|
| Sector | Manufacturing (sector 11 - manufacturing) |
| Size | Medium enterprise (>50 employees) |
| Revenue | >EUR 10 million |
| NIS2 Status | Important Entity |
| Supervisory authority | National cybersecurity authority |
2. Gap Analysis - 10 NIS2 Areas
| NIS2 Area | Current | Required | Gap |
|---|---|---|---|
| 1. Risk management policies | 2/5 | 4/5 | High |
| 2. Incident management | 1/5 | 4/5 | Critical |
| 3. Business continuity (BCP/DR) | 3/5 | 4/5 | Medium |
| 4. Supply chain security | 1/5 | 3/5 | High |
| 5. Security in SDLC | N/A | N/A | Not applicable |
| 6. Control effectiveness assessment | 2/5 | 3/5 | Medium |
| 7. Basic cyber hygiene | 3/5 | 4/5 | Medium |
| 8. Cybersecurity training | 2/5 | 3/5 | Medium |
| 9. Cryptography and encryption | 3/5 | 4/5 | Medium |
| 10. HR security | 3/5 | 3/5 | OK |
3. Implementation Roadmap
Phase 1: Quick Wins (Month 1-2)
- MFA implementation for admins
- Incident reporting procedure to CSIRT
- Backup policy and recovery tests
Phase 2: Foundations (Month 3-6)
- Incident management system
- Security policies (complete set)
- Security awareness program
Phase 3: Maturation (Month 7-12)
- Vendor risk management
- Penetration testing and vulnerability management
- Continuous monitoring (SIEM/SOC)
4. Cost Estimate
| Element | Scope | Estimate |
|---|---|---|
| Documentation (policies, procedures) | 15 documents | €7,000 - €11,500 |
| Technical implementation (SIEM, VM) | Licenses + deployment | €18,500 - €34,500 |
| Training | Board + employees | €3,500 - €6,000 |
| vCISO / oversight (12 months) | Gold package | €96,000 - €150,500 |
| TOTAL | €125,000 - €202,500 |
Estimate only, final quote after detailed scoping
NIS2 audit vs IT security audit and penetration test
A NIS2 audit checks the organization’s compliance with the directive and the KSC Act: processes, documentation, risk management, incident reporting and supply chain. An IT security audit assesses the configuration and safeguards of your infrastructure, and a penetration test checks in practice whether they can be broken. IT audit and pentest results can serve as evidence in a NIS2 audit, but do not replace it — and vice versa: the standard scope of the NIS2 audit does not include technical tests that interfere with your environment, so it does not disrupt your systems.
Not sure yet whether NIS2 applies to you at all? The free NIS2 readiness assessment gives an initial orientation.
Why Start with Readiness Check?
Scenario A: Without Readiness Check
- You sign a contract for “NIS2 implementation” for €46,000
- After 2 months you find out you don’t fall under NIS2
- Or: you do fall under it, but already have 60% of requirements covered by ISO 27001
- You overpaid - but contract is signed
Scenario B: With Readiness Check
- You pay €3,500 for Readiness Check
- You find out you don’t fall under NIS2 → you save €46,000
- Or: you do fall under it, but gap is only 40% → implementation for €18,500 instead of €46,000
- You have full knowledge before making a decision
Pricing
Standard Readiness Check
For companies up to 200 employees:
- Legal status verification
- 1-day discovery session
- Gap analysis vs 10 NIS2 areas
- Implementation roadmap
- Cost estimate
- 2h results session
Time: 2 weeks Price from: €3,500 net
Enterprise Readiness Check
For larger organizations or complex structures:
- Multiple locations/business units
- Extended discovery (2-3 days)
- Detailed technical review
- Multiple stakeholder interviews
- Board presentation
Time: 3-4 weeks Price: individual quote after scoping
The Readiness Check and implementation are only the beginning: once you achieve compliance, you have to maintain it — collect evidence, update the risk register, policies and procedures, and report to the management board. We describe the scope of this ongoing cycle in the section on NIS2 and KSC compliance maintenance.
Which NIS2 service should you choose?
At nFlo, NIS2 preparation is three consecutive steps. Each one is a separate service with its own price — you can start with any of them and stop there.
| NIS2 Readiness Check | NIS2/KSC audit (gap analysis) | NIS2 implementation (NIS2 and DORA Compliance) | |
|---|---|---|---|
| Question it answers | Does NIS2 apply to us and how much will implementation cost? | Which NIS2 and KSC Act requirements do we not meet? | How do we achieve compliance and prepare for a regulator audit? |
| Depth | Legal qualification, 1-day discovery session, maturity scoring (1-5) across 10 NIS2 areas | Entity classification and gap analysis of the 10 requirement areas based on evidence and interviews, including risk management, incident reporting and supply chain | Gap analysis, roadmap, policies and procedures, technical control implementation, training, regulator audit preparation |
| Deliverable | Report (20-30 pages), executive summary, roadmap, implementation cost estimate | Gap report with a compliance implementation plan and timeline | Implemented controls and compliance documentation |
| Who it is for | You don’t know whether NIS2 applies to you and the board wants a business case before the budget decision | You know you are an essential or important entity and need a formal gap report | You know your gaps or are starting from scratch and want to go all the way to compliance |
| Time | 2 weeks (Enterprise: 3-4 weeks) | 7-12 business days | 3-9 months |
| Price (net) | from €3,500 (Enterprise: individual quote after scoping) | from €6,000 (BASIC package: €6,000–€10,500) | €13,000–€50,500 including the gap analysis; with support during the authority’s audit from €64,000 |
The gap analysis within implementation is the same scope and price as the BASIC NIS2/KSC audit — the implementation price already includes it. On the KSC compliance page, Model 1 is the NIS2/KSC audit and Model 2 is NIS2 implementation from this table; compliance maintenance (Model 3) starts from €1,200 net/month, and the variant with the KSC compliance officer role from €2,100 net/month. Prices apply to NIS2 and the KSC Act (the Polish act implementing NIS2) — DORA is quoted separately.
Details: NIS2 Readiness Check · NIS2/KSC audit · NIS2 and DORA Compliance · KSC compliance
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Qualification
Verification if your company falls under NIS2
Discovery
1-day session with IT, security, legal
Analysis
Current state vs 10 NIS2 requirement areas
Report
Gap analysis + roadmap + implementation estimate
Benefits for your business
What you gain by choosing this service.
Clarity
You know if you're in scope and what to do
Cost savings
Don't overpay for full implementation before knowing scope
Speed
2 weeks instead of 2 months of discovery
Prioritization
You know where to start
Related Articles
Expand your knowledge with our resources.
Continuous cloud compliance: how do CSPM, PCI DSS and automated remediation replace the once-a-year audit?
The audit confirmed the cloud environment was compliant in March, and in April someone opened a database port for a test and forgot to close it. We show how to turn an annual check into continuous configuration measurement that produces audit evidence on its own.
Read more →Third-party vendor access to critical systems: how do you control it under DORA?
The integrator of your core system, the firm that maintains your databases, the infrastructure service provider — each of them logs into systems your institution is accountable for, not theirs. We show how to turn DORA and Delegated Regulation 2024/1774 into concrete decisions about the account, the session and the evidence for audit.
Read more →Network traffic analysis with NetFlow and IPFIX flows: what you see, what you miss and how it supports NIS2
The firewall guards the perimeter, EDR guards devices with an agent. Traffic between servers, printers and cameras inside the network falls outside both. We show what can be detected from flows alone, when you need packet capture and what network data you need within 24 hours of detecting an incident.
Read more →Frequently Asked Questions
Common questions about NIS2 audit — Readiness Check and gap analysis.
How will I know if my company falls under NIS2?
As part of the Readiness Check, we verify your sector (18 NIS2 sectors), company size, and revenue. You receive a clear-cut answer: Essential Entity, Important Entity, or Not in scope - with legal justification.
How much does the NIS2 Readiness Check cost and how long does it take?
The Readiness Check costs from €3,500 and takes 2 weeks. In the first week, we conduct legal verification and a one-day discovery session; in the second week - gap analysis and a report with roadmap. For larger organizations or complex structures there is an Enterprise variant: 3-4 weeks, individual quote after scoping.
What if it turns out I don't fall under NIS2?
You receive a report with legal justification explaining why you are not in scope - you can present it to the board or auditors. You save on unnecessary implementation. This is one of the main reasons to start with a Readiness Check instead of a full project.
After the Readiness Check, do I have to purchase full implementation from you?
No. The Readiness Check is an independent service. You receive a report with a roadmap and estimate - you can implement on your own, with us, or with another provider. There is no lock-in.
We already have ISO 27001 - is NIS2 the same thing?
No, but ISO 27001 covers a significant portion of NIS2 requirements. The Readiness Check will show you exactly which areas you already have covered and how much work remains - typically, companies with ISO 27001 already have a significant share of NIS2 requirements fulfilled.
How do the two levels of the NIS2 audit — Readiness Check and gap analysis — differ?
The Readiness Check (from €3,500, 2 weeks) answers whether NIS2 applies to you and how much implementation will cost: legal qualification, a 1-day discovery session and maturity scoring (1-5) across 10 areas. The NIS2/KSC audit — gap analysis (from €6,000, BASIC package €6,000–€10,500, 7-12 business days) is for organizations that know they are an essential or important entity: entity classification and an assessment of the 10 requirement areas based on evidence and interviews, resulting in a gap report with a compliance implementation plan and timeline.
Does the NIS2 audit disrupt our systems?
No. The standard scope of the NIS2 audit at both levels relies on interviews, a review of documentation and evidence, and a walkthrough of critical systems — it does not include technical tests that interfere with your environment. If you need vulnerabilities tested in practice, that is a separate service — penetration testing.
Is a NIS2 audit mandatory, and from when?
In Poland, NIS2 is implemented by the Act of 23 January 2026 amending the Act on the National Cybersecurity System (Journal of Laws 2026 item 252), in force since 3 April 2026. The mandatory security audit of the information system under Art. 15(1) applies to essential entities: at least once every 3 years, for the first time within 24 months of meeting the conditions for being recognized as an essential entity (Art. 16). An essential or important entity has 12 months to meet the obligations of Chapter 3 of the Act. The Readiness Check and gap analysis are a voluntary gap assessment — they do not replace the Art. 15 audit, but show what to fix before it.
How does a NIS2 audit differ from an IT security audit and a penetration test?
A NIS2 audit checks the organization's compliance with the directive and the KSC Act — processes, documentation, risk management, incident reporting, supply chain. An IT security audit assesses the configuration and safeguards of your infrastructure, and a penetration test checks in practice whether they can be broken. IT audit and pentest results can serve as evidence in a NIS2 audit, but do not replace it.
How should we prepare for a NIS2 audit?
Gather your existing policies and procedures, results of earlier audits (e.g. ISO 27001), a list of critical systems and key suppliers, and nominate people from IT, security and management for the interviews.
What happens after the NIS2 audit?
You receive a report with a roadmap and priorities — you can implement on your own, with another provider, or with us as part of the NIS2 implementation service. Once compliance is achieved, it needs to be maintained (Model 3 of the KSC compliance service).
Does the NIS2 audit apply to small companies?
As a rule, the NIS2 rules cover companies from medium-sized enterprises upwards, but some entities are covered regardless of their size. For an initial orientation before ordering an audit, use the free NIS2 readiness assessment in the Tools section.