NIS2 implementation check
15 questions on the ten measures of § 30 BSIG. You see your maturity per measure right away, and which requirements you cannot yet evidence to the BSI.
No sign-up. Instant result, no form.
Is there a documented risk analysis for your IT and networks?
With assessed risks, treatment decisions and owners, updated regularly and after changes.
The ten measures of § 30 BSIG
Important and essential entities must take and document appropriate, proportionate and effective measures. § 30(2) BSIG lists the areas these measures must cover at least.
Not sure yet whether NIS2 applies to you? Start with the NIS2 applicability check.
- 01
Risk analysis and security policies
Assess and treat risks to IT and networks and maintain security policies.
- 02
Incident handling
Detect and handle security incidents and report significant ones on time.
- 03
Business continuity and crisis management
Backups, disaster recovery and crisis management.
- 04
Supply chain security
Security requirements for direct suppliers and service providers.
- 05
Vulnerability management, acquisition and maintenance
Security in acquisition, development and maintenance, including vulnerability management.
- 06
Effectiveness assessment
Policies and procedures to assess whether the measures are effective.
- 07
Cyber hygiene and training
Basic cyber hygiene and IT security training.
- 08
Cryptography and encryption
Policies and procedures for cryptography and encryption.
- 09
Personnel, access control and assets
Personnel security, access control and asset management.
- 10
MFA and secure communication
Multi-factor authentication, secured communication and emergency communication.
How it is scored
Each question has five levels. A measure's maturity is the average of its questions; the overall score weighs all ten measures equally. Only the top level counts as evidenced.
- 0Not in placeWe have nothing for this yet.
- 1InformalDone in practice, but ad hoc and undocumented.
- 2DocumentedRules exist but are not applied everywhere.
- 3ImplementedApplied consistently across the organization.
- 4EvidencedImplemented, reviewed regularly, with current evidence.
From gap to control
Every question is linked to the matching controls of the NIS2 catalog in Secani. A gap in the check is not a recommendation on paper but a concrete control with the evidence it expects.
When you take the result to Secani, we set up a workspace with the NIS2 catalog and pre-assess the controls from your answers. You continue with the open items instead of capturing your status a second time.
Frequently asked questions about the NIS2 implementation check
For organizations that are, or expect to be, important or essential entities under the BSI Act. Whether your organization is in scope is what the NIS2 applicability check answers first.
§ 30(2) BSIG names ten areas: risk analysis and security policies, incident handling, business continuity, supply chain security, security in acquisition, development and maintenance, effectiveness assessment, cyber hygiene and training, cryptography, personnel security with access control and asset management, and multi-factor authentication with secured communication.
The measures must be implemented and documented. The BSI can request evidence, and under § 38 BSIG management must oversee the implementation. The check therefore reports an implemented measure without current evidence as an evidence gap.
No. The maturity per measure appears right after the last question. We only need your name, company, email and role if you want the detailed gap report by email.
Secani sets up a workspace with the NIS2 catalog and pre-assesses the controls that belong to your answers. You keep working on open controls there, with owners, deadlines and evidence.
No. The check is a non-binding self-assessment based on your answers. It does not replace an audit or a legal assessment, but it shows where to start.
How far along are you with NIS2?
Find out in a few minutes, measure by measure.
Sources and status
Status: 19 October 2026. The BSI Act as amended is decisive, in particular §§ 30, 32 and 38, and for certain digital services Implementing Regulation (EU) 2024/2690.