NIS2 & CRA Readiness Check

Do you have a documented risk-analysis and information-security policy that's reviewed at least annually?

Do you have a formal incident-response plan with a defined escalation path and a process for meeting regulator notification timelines?

Has that plan been tested with a tabletop exercise or simulated incident in the last 12 months?

Do you have a documented business-continuity and disaster-recovery plan for your critical systems?

Do you assess the security posture of key suppliers and third-party vendors before onboarding them?

Is multi-factor authentication enforced for all privileged and remote-access accounts?

Do you have a defined process for handling and disclosing vulnerabilities found in your own products or systems?

Do you maintain a software bill of materials (SBOM), or an equivalent inventory of third-party components in your products?

Has an external party — not your own team — performed a penetration test or security assessment on your critical systems in the last 12 months?

Could you hand an auditor documented evidence today — not just policy — that these controls are actually in place?

Do you know whether your organization qualifies as an "essential" or "important" entity under NIS2, and which specific obligations apply to you?

If a critical vulnerability were found in a customer-facing system tomorrow, could your team ship a fix and notify affected parties within 72 hours?