NIS2 Compliance
The NIS2 module helps organizations assess their compliance with the EU NIS2 Directive (Network and Information Security). It provides a structured questionnaire, automated scoring, gap analysis, and exportable reports.
Plan requirement: OPS and above.
WHAT IS NIS2
Section titled “WHAT IS NIS2”The NIS2 Directive (EU 2022/2555) establishes cybersecurity obligations for essential and important entities across the EU. It requires organizations to implement risk management measures, incident reporting, and supply chain security.
Organizations that fall under NIS2 must demonstrate compliance or face penalties up to 10 million EUR or 2% of global turnover.
6 ASSESSMENT DOMAINS
Section titled “6 ASSESSMENT DOMAINS”CheckOps evaluates your organization across 6 NIS2 domains:
| Domain | Questions | Weight | Topics |
|---|---|---|---|
| Governance | 3 | 20% | Risk management policy, board oversight, CISO role |
| Incident Management | 3 | 20% | Detection, response plan, reporting (24h/72h) |
| Business Continuity | 3 | 15% | DR plan, backup strategy, RTO/RPO targets |
| Supply Chain | 3 | 15% | Vendor assessment, SLA monitoring, third-party risk |
| Technical Measures | 3 | 20% | MFA, encryption, network segmentation, patching |
| Training & Awareness | 3 | 10% | Security training, phishing exercises, awareness |
HOW SCORING WORKS
Section titled “HOW SCORING WORKS”Each question is scored on a scale of 0 to 4:
| Score | Level | Description |
|---|---|---|
| 0 | Non-existent | No process or control in place |
| 1 | Initial | Ad-hoc, undocumented |
| 2 | Developing | Partially implemented, some documentation |
| 3 | Defined | Fully documented and consistently applied |
| 4 | Optimized | Continuously improved with metrics |
Domain scores are weighted and combined into a global score (0-100):
- 0-25 — Critical gaps, non-compliant
- 26-50 — Significant gaps, major remediation needed
- 51-75 — Partially compliant, targeted improvements required
- 76-100 — Largely compliant, minor refinements
GAP ANALYSIS
Section titled “GAP ANALYSIS”After completing the assessment, CheckOps generates a gap analysis that identifies:
- Critical gaps — Areas where you scored 0-1 that require immediate action
- Improvement areas — Scores of 2 that need documentation or process formalization
- Recommendations — Specific actions to improve each domain score
- Priority ranking — Gaps ordered by risk impact and remediation effort
REPORTS
Section titled “REPORTS”Assessment results can be exported as:
- JSON — For integration with GRC tools
- PDF — Formatted report with scores, radar chart, gap analysis, and recommendations
Reports include a timestamp and version number for audit trail purposes.
ASSESSMENT WORKFLOW
Section titled “ASSESSMENT WORKFLOW”- Navigate to NIS2 Compliance in the dashboard
- Complete the 18-question assessment (can be saved as draft)
- Review scores and gap analysis
- Export report as needed
- Re-assess periodically to track improvement
Assessment results are stored in your CheckOps organization and can be compared over time to demonstrate compliance progress.
API ACCESS
Section titled “API ACCESS”NIS2 scoring is also available via API for automated compliance pipelines:
curl -X POST https://api.checkops.eu/api/toolbox/nis2 \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{"answers": {...}}'The response includes domain scores, global score, and gap analysis.