NIS2 Article 21 Gap Assessment Workflow

Confirm whether the entity, service, country implementation, and sector facts bring the activity within NIS2 before scoring controls. Article 21 applies to essential and important entities, but Member State implementation and sector-specific rules can affect the practical evidence request.

For the gap assessment, record the risk context that Article 21 uses: state of the art, relevant European and international standards where applicable, cost of implementation, entity size, exposure to risk, and the likelihood and severity of incidents.

Use Article 21(2) as the control taxonomy for the first pass. Each row should name the current control, owner, system or process covered, evidence location, gap rating, and remediation action.

Do not collapse supplier security, incident handling, access control, cryptography, and business continuity into one generic security-policy row. Article 21 expects coverage across multiple technical, operational, and organisational measure areas.

Commission Implementing Regulation (EU) 2024/2690 gives detailed technical and methodological requirements for specific digital infrastructure, ICT service management, digital provider, and trust-service entity types named in Article 21(5). Use it directly for those covered entities and as useful guidance only when another entity is outside that regulation's scope.

When it applies, align the gap assessment to the regulation's annexed requirements and ENISA's evidence examples. For other NIS2 entities, record the national rule or supervisory expectation that turns Article 21 into a concrete control requirement.

A useful gap assessment is not a maturity score alone. Each row should let a reviewer trace the requirement to the actual control, proof, owner, and decision on residual risk.

Use evidence that shows the measure is in place and maintained. ENISA examples include documented frameworks, risk assessments, treatment plans, approval records, procedures, logs, organisational charts, and review change logs, depending on the requirement being assessed.

Article 20 links Article 21 measures to management-body approval, oversight, training, and potential liability under Member State law. The close-out package should therefore be ready for management review, not only security-team tracking.

Before closing the assessment, confirm that residual risks have been accepted by the right governance body or accountable role, that corrective measures are tracked without undue delay where non-compliance is found, and that the evidence can be retrieved for customers, auditors, or competent authorities.