NIS2 gap analysis: where does your organisation stand?

A gap analysis compares the current state of your information security with the requirements of the German BSI Act: scope and registration, the ten areas of measures, incident reporting and the duties of the management body. The result shows which duties are fulfilled, where gaps exist and which of them are most urgent.

The quick check covers 19 critical items and takes about 10 minutes. The complete analysis with all items takes longer and provides the basis for an action plan. You can pause at any time; your progress stays stored in the browser.

All entries stay in your browser. Nothing is transmitted to VamiSec or third parties. You can save your progress as a file, export it as a table or print it as a report.

Two questions are decisive: does your organisation belong to one of the entity types named in the BSI Act, and does it reach the size thresholds? An important entity is one with at least 50 employees, or with annual turnover and balance sheet total of more than EUR 10 million each. Some entities are covered regardless of their size.

The BSI scoping check gives a first indication. It is not legally binding; you make the classification yourself and should document it.

The BSI Act has applied since 6 December 2025; there is no general transition period. Registration is due no later than three months after an entity comes into scope. For entities in scope from the start, this deadline ended on 6 March 2026. Significant incidents are subject to reporting deadlines of 24 hours, 72 hours and one month.

You register in the BSI portal. This requires an ELSTER organisation certificate, which you apply for through the German business account service “Mein Unternehmenskonto”. The details to provide include name and legal form, contact details, public IP address ranges, the sector and the EU member states in which you operate. Changes must be notified within two weeks.

Significant incidents must be reported, meaning incidents that cause or can cause severe operational disruption or financial loss, or that considerably harm others. An early warning is due no later than 24 hours after becoming aware, a notification with an initial assessment after 72 hours at the latest, and the final report no later than one month after that. The BSI recommends the principle of speed before completeness.

The management body must implement the measures, oversee their implementation and take part in regular training. In the event of a culpable breach of duty, it is liable to its own company for the resulting damage under the rules of company law. According to the BSI, responsibility remains with management even when IT tasks are outsourced.

For the training, the BSI has published guidance and a sample curriculum. Both are orientation aids and not binding requirements.

For breaches of the duties on measures, documentation and reporting, the BSI Act provides for fines of up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities. For organisations with a total turnover above EUR 500 million, the range can instead be up to 2 % or 1.4 % of worldwide turnover in the preceding year. A missing or late registration can be fined with up to EUR 500,000. These are upper limits.

According to the BSI, a management system in line with ISO/IEC 27001 is a sound foundation and, when implemented comprehensively, regularly covers a large part of the required measures. It does not automatically fulfil the statutory requirements: the scope of such a system can be chosen freely, whereas the Act concerns the entire entity. Registration, reporting deadlines and the duties of the management body are not part of the standard.

In the gap analysis, each item shows its link to ISO/IEC 27001.

For financial entities covered by DORA, its rules on risk management and incident reporting take precedence; according to the BSI, registration with the BSI is still required. The Cyber Resilience Act addresses manufacturers of products with digital elements and governs the security of these products, whereas NIS2 concerns the security of the organisation and its services. A manufacturer can therefore fall under both sets of rules.

You are directly obliged only if you meet the criteria of the Act yourself. Entities in scope must, however, take the security of their direct suppliers and service providers into account and therefore often pass requirements on by contract, for example through security questionnaires, evidence or commitments to report incidents. It helps to be able to evidence your own measures. The self-assessment is also suitable as a baseline for this.

No. The self-assessment is a self-evaluation and not an audit opinion. It is not legal advice, not a certification and not evidence towards the BSI. It helps you to recognise the need for action and to prepare discussions with experts.