Step 01 · Profile

Who is your organisation?

Sector and size determine whether you're an essential or important entity under NIS2 — that changes the severity of every finding.

Sector of activity REQUIRED

Please select a sector.

Number of employees REQUIRED

1–49 50–249 250+

Please select a size.

Annual turnover REQUIRED

< €10m €10–50m > €50m

Please select a turnover range.

Countries of operation REQUIRED

Greece Other EU United Kingdom United States Other

Please select at least one.

Number of legal entities REQUIRED

Enter a number from 1–1000.

Step 02 · Scope

What do you want to cover?

Select the frameworks and areas in scope. Whatever you don't select isn't scored.

Compliance frameworks REQUIRED

ISO/IEC 27001 ISO/IEC 42001 NIS2 DORA GDPR SOC 2

Please select at least one framework.

Areas in scope REQUIRED

IT infrastructure OT / industrial Cloud (IaaS/PaaS) SaaS / M365 Software product Remote work

Please select at least one area.

Number of sites REQUIRED

Enter a number from 1–500.

Critical suppliers REQUIRED

0–5 6–15 16–30 31+

Please select a range.

Step 03 · Governance

How is security governed?

These questions cover the foundations of the ISMS — and the liability of the management body under NIS2 Article 20.

Is there an approved information security policy? REQUIRED

Yes No Not sure

When was it last approved?

Please answer.

Is there a designated person responsible for security? REQUIRED

Yes No

Please answer.

Has a risk assessment been done in the last 12 months? REQUIRED

Yes No Not sure

When?

Please answer.

Is there a risk register with owners? REQUIRED

Yes, up to date Partial No

Please answer.

Does the board review security at least twice per year? REQUIRED

Yes No

When was the last time?

Please answer.

Step 04 · Access

Who has access and how?

Authentication and access reviews are the most common findings in Greek SMEs.

MFA on remote access (VPN, webmail, SaaS)? REQUIRED

Yes, everywhere Partial No

Please answer.

MFA on administrator accounts? REQUIRED

Yes, everywhere Partial No

Please answer.

Has an access rights review been done in the last 6 months? REQUIRED

Yes No

When?

Please answer.

Is there a documented joiner / leaver process? REQUIRED

Yes Partial No

Please answer.

Step 05 · Operations

Incidents, continuity, suppliers

The heart of operational resilience — and where NIS2 has its strictest requirements.

Is there a documented incident response process? REQUIRED

Yes No

Please answer.

Is there a designated person for incidents? REQUIRED

Yes No

Please answer.

How many security incidents in the last 12 months? REQUIRED

If you don't know, put 0 — and treat it as a finding.

Enter a number from 0–9999.

Is there a process for reporting to an authority within 24 hours (NIS2)? REQUIRED

Yes No Not applicable

Please answer.

Is there a documented business continuity / recovery plan? REQUIRED

Yes No

When was it approved?

Please answer.

Has the plan been tested in the last 12 months? REQUIRED

Yes No

Please answer.

Is there a classified list of critical suppliers? REQUIRED

Yes No

Please answer.

Are there security clauses in supplier contracts? REQUIRED

Yes Partial No

Please answer.

Has a supplier security assessment been done in the last 12 months? REQUIRED

Yes Some No

Please answer.

Is there security / phishing training for staff? REQUIRED

Yes, regularly Occasionally No

Please answer.

Do you track training completion? REQUIRED

Yes No

Please answer.

Is there EDR / AV on all endpoints? REQUIRED

Yes, on all On most No

Please answer.

Is there a patch management process with SLAs? REQUIRED

Yes Informal No

Please answer.

Anything else we should know? optional

Step 06 · Review

Review your answers

See what will be sent. If something isn't right, go back and correct it. Preliminary findings are indicative — based on self-declared answers, without evidence verification.

Email for the report REQUIRED

Your email app will open with your answers ready to send.

Please enter a valid email.

I agree to the privacy policy and to the use of my data to send the report. Data is not shared with third parties and I can request deletion at any time.

Consent is required to continue.

Step 07 · Verify

Confirm your email

We sent a 6-digit code to . The code is valid for 10 minutes.

Verification code

Incorrect code. Please try again.

Thank you

We opened your email app with your answers ready. Press Send and we'll reply to with preliminary findings and coverage. Didn’t open? Send it from here.

This analysis is based on self-declared answers and is not a compliance audit. Before using it in communication with a certification body, evidence verification is required.

Reference — Status Processing

Back to home

Payload to backend

Gap analysis in 7 steps

Thank you