Translate
Free NIS2 self-assessment mapped to ISO/IEC 27001 Free NIS2 self-assessment mapped to ISO/IEC 27001

Free NIS2 self-assessment mapped to ISO/IEC 27001

  • Update: 03/11/2026

NIS2 asks essential and important entities to prove that ten minimum security measures are in place and that incidents are reported within 24 and 72 hours. Before you plan training or an ISO/IEC 27001 project, you need to know where the gaps are. GoToCertify has released a free NIS2 self-assessment that tells you exactly that, mapped control by control to ISO/IEC 27001:2022.

What the NIS2 self-assessment covers

The questionnaire contains 69 requirements in 14 areas, built on Article 20 (management-body accountability), Article 21 (the ten cybersecurity risk-management measures), Article 23 (incident reporting) and the thresholds of Implementing Regulation (EU) 2024/2690. Every one of the 93 Annex A controls of ISO/IEC 27001:2022 is linked to at least one requirement, so the result doubles as a first ISMS gap analysis.

  • Governance, management training and accountability
  • Risk analysis, policies, business continuity and supply-chain security
  • Incident handling and the 24h / 72h / one-month reporting timeline
  • Secure development, vulnerability handling, cryptography, access control and MFA
  • Interplay with DORA, the CER Directive and the Cyber Resilience Act

How it works

A short profile removes the requirements that do not apply to your organisation. Each remaining requirement is scored from 0 (not started) to 4 (fully compliant), with fields for evidence, owner and target date. The dashboard shows compliance by area, by legal source and by ISO 27001 control group, and highlights P1/P2 priority gaps.

The assessment runs entirely in your browser: no account, and your answers are not sent to a server. You can download a save file and pick up where you left off. The questionnaire, dashboard and summary PDF are free; GoToCertify Pro (18 EUR including VAT, 45 days, no subscription) adds per-requirement guidance, a full PDF report with your logo, an evidence tracker and Excel export.

Start the free NIS2 self-assessment →

From gap analysis to competence

Article 20 requires members of the management body to follow training, and the self-assessment will usually show where people, not tools, are the gap. ExamSimul can help with the next step:

Exams are delivered online through GoToCertify, one of the examination institutes ExamSimul works with.

The self-assessment is an information tool, not legal advice. National transposition laws may add obligations: check them against the official texts.

Share

ExamSimul - is the training division of BITIL.COM - an organization of professionals and senior experts whose main interest is the spread of knowledge and the application of methodologies Agile, Scrum, ITIL®, PRINCE2®, CobiT®, TOGAF®, Design Thinking and Standard International. [...]

Top