Entry service
NIS2 gap analysis: where your organisation stands today
The NIS2 gap analysis shows how far your technical and organisational measures are from the requirements of Section 30 of the German BSI Act (BSIG) and what to do first. You choose the depth in three tiers, from a reasoned indication to a twelve-month implementation plan, and receive a written report as a basis for management decisions.
Which questions does the gap analysis answer?
For entities in scope, the Section 30 BSIG duties have applied since 6 December 2025, with no general transition period. Management has to oversee implementation, and compliance has to be documented. Before you set budget and priorities, three questions need answers: where do we stand in each requirement area, which gaps matter most, and what will it cost to close them?
The gap analysis answers these questions for your organisation. It is a technical and organisational assessment: we compare the core requirement areas with how you actually operate, review documents, talk to IT, your service provider and the people responsible, and take targeted technical samples. If you already work to ISO 27001, TISAX or the IT-Grundschutz of the BSI (Federal Office for Information Security), we reuse existing evidence rather than duplicating work.
The report is built for action: it shows what to do next, with risk and effort, and is written so that your management can decide and oversee implementation on that basis.
What you receive
Which results you get depends on the tier. We walk you through the written report in every tier.
01
Readiness indication with rationale
An assessment per requirement area with a short rationale and reference to the documents and samples it is based on. All tiers.
02
Mapping of existing controls
Where you work to ISO 27001, TISAX or IT-Grundschutz: which existing evidence we credited and where NIS2 asks for more. All tiers, where applicable.
03
Top-10 gap view
The ten gaps that weigh most in our assessment, with cause and effect. Gap and Roadmap.
04
Prioritised action catalogue
Actions with risk, effort and sequence, quick wins first. Gap and Roadmap.
05
Twelve-month implementation plan
Sequence, dependencies, owners and effort estimates as a budget basis. An improvement plan: the duties already apply, the plan only sets the order in which you close gaps. Roadmap.
06
Report and walkthrough
A written report as the basis for management decisions and a walkthrough with you and, if you wish, your management. All tiers.
Sample result (fictitious, excerpt)
This is what an excerpt of the top-10 gap view looks like. Fictitious example, not a client: a food wholesaler with 140 employees, an important entity (wichtige Einrichtung) under Annex 2 BSIG. One person runs IT, an IT service company looks after servers, network and remote maintenance; email and file storage run in Microsoft 365.
| Requirement area | Finding | Rating | Priority | Action |
|---|---|---|---|---|
| Recovery (no. 3) | Daily backups, restore of the merchandise management system never tested | missing | high | Restore test with timing, record, define recovery order |
| MFA (no. 10) | MFA for Microsoft 365, not for VPN and admin accounts | partial | high | Extend MFA to VPN and all admin accounts, coverage report |
| Privileged access (no. 9) | Provider holds permanent domain admin access, sessions not logged | partial | high | Grant access only when needed, log sessions |
| Reporting (no. 2, Section 32) | No process for who decides on reporting; reachable during office hours only | missing | high | Reporting process with roles and emergency contacts, then a drill |
| Supply chain (no. 4) | Provider contract without a duty to report security incidents and without patch deadlines | partial | medium | Provider assessment, contract amendment on incidents and patching |
| Vulnerabilities (no. 5) | Servers patched monthly, firewall firmware unchanged for two years | partial | medium | Update firmware, include network devices in patch process |
| Assets (no. 9) | Inventory lacks warehouse scanners and scales | partial | medium | Complete inventory, flag critical systems |
| Evidence (Section 30(1)) | Several measures in place but not documented anywhere | partial | medium | Register of measures with status, owners and storage location |
Fictitious, shortened example with no connection to any client. Ratings and priorities are illustrative; a real analysis covers all requirement areas. Mapping to Section 30(2) BSIG is our own assessment. Rating levels: implemented, partial, missing.
What do we assess?
The assessment covers ten areas to which we map the technical and organisational requirements of Section 30(2) BSIG. The number in brackets is our mapping to the Act.
What do we have?
Assets and critical systems
Inventory, owners and the systems your services cannot run without (no. 9).
What is still open?
Vulnerabilities and patching
How updates are applied, how long vulnerabilities stay open and who tracks them (no. 5).
Would we notice?
Logging and detection
Which events are logged and reviewed, and whether an attack would be noticed. A prerequisite for handling incidents (no. 2).
What if it happens?
Incident handling and reporting
Process, roles, availability outside business hours and the ability to meet the Section 32 deadlines (no. 2).
Can we recover?
Backup, recovery, emergency operation
Backups, tested recovery and what has to keep running in an emergency (no. 3).
Who has full access?
Administrators and privileged access
Admin accounts, service accounts, provider access and how they are protected and reviewed (no. 9).
Is a password enough?
MFA and access control
Multi-factor authentication coverage across remote access, cloud services and administration (no. 10).
Who decides?
Roles, responsibilities, reporting lines
Responsibilities, security policies and how management is informed and exercises oversight (no. 1, Section 38(1)).
Who works for us?
Supply chain and service providers
Critical providers, contracts, access and how supply chain risks are managed (no. 4).
Can we prove it?
Evidence and documentation
Whether implementation is documented as Section 30(1) requires and whether the evidence is complete and traceable.
What does the NIS2 gap analysis cost?
Choose the tier by the depth of insight you need. We agree the right one in the scoping call.
| Service | Indication | Gap | Roadmap |
|---|---|---|---|
| Readiness indication across the core requirement areas, with rationale | yes | yes | yes |
| Mapping of existing controls (ISO 27001, TISAX, IT-Grundschutz) | yes | yes | yes |
| Top-10 gap view and prioritised actions with risk and effort | - | yes | yes |
| Twelve-month implementation plan with effort estimates | - | - | yes |
| Written report and walkthrough | yes | yes | yes |
| Indicative price | from €3,400 net plus VAT | from €5,700 net plus VAT | from €9,900 net plus VAT |
Offered exclusively to businesses (B2B). All prices are indicative, net plus VAT. We quote the fixed price in our proposal after the scoping call; it depends mainly on size, number of sites and number of service providers.
How does the gap analysis work?
Four phases. Effort figures are indicative and depend on tier and size.
1
Scoping (about half a day)
Sector, size, existing certifications and providers; choice of tier.
2
Data collection (1-2 days)
Workshops, document review, targeted technical samples.
3
Analysis (2-4 days)
Assessment per requirement area, gaps, prioritisation by risk and effort.
4
Report and walkthrough (1 day)
Delivery of the report and walkthrough, with your management if you wish.
You usually receive the report within 10 working days after data collection is complete. We do not need access to production data; technical samples are agreed with you and your provider in advance.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
NIS2 Quick Check: now the NIS2 gap analysis
This service was previously listed as the “NIS2 Quick Check” on www.blackfort-tec.de. Tiers, scope and indicative prices have stayed the same; description, name and address are new. If you came from the old page, you are in the right place.
What we need from you
A contact person with an overview of IT and organisation, the documents that exist (policies, provider contracts, network diagram, backup concept, existing certificates or audit reports) and time for workshops with IT, your provider and the people responsible. For the Roadmap tier we also need an idea of the capacity available internally and at your provider. We work in German and English.
What the gap analysis is not
To set expectations:
- Not legal advice. You determine whether and in which category your organisation is in scope; we work with your classification and point out questions to have checked legally.
- No certificate and no confirmation of NIS2 compliance. There is no NIS2 certification. The analysis is also not an audit by an independent body of the kind the BSI can order under Section 61 BSIG.
- Not a penetration test. Technical samples are part of it, a full security test is not.
- Not implementation. You implement the measures yourselves, with your provider or with us; that is agreed separately.
The report is our professional assessment to prepare your decisions.
Frequently asked questions
Is this the former NIS2 Quick Check?+
Yes. The NIS2 Quick Check from www.blackfort-tec.de is now called the NIS2 gap analysis and lives on this website. Tiers, scope and indicative prices have stayed the same; description and name are new.
Is the gap analysis legal advice?+
No. We assess technical and organisational implementation. Legal borderline cases, for example on classification or liability, are for your legal counsel. The report can serve as a working basis for them.
We are ISO 27001 certified. Do we still need it?+
That depends on the scope of your ISMS. According to the BSI, a fully implemented ISMS covers a large part of Section 30 BSIG but does not automatically meet all duties: the ISMS scope can be chosen freely, ISO 27001 allows risk acceptance, and registration, reporting deadlines and management duties are not part of the standard. We credit existing controls and show where NIS2 asks for more.
Gap or Roadmap, which tier fits?+
If you want to move straight into implementation and need a twelve-month budget basis, choose Roadmap. If you first need clarity on the biggest gaps, Gap is enough. The Indication suits you if you quickly need a reasoned assessment for management.
When should we do the analysis?+
As soon as possible. The Section 30 BSIG duties have applied to entities in scope since 6 December 2025 and do not depend on registration. The sooner you know where you stand, the sooner your budget goes to the measures that achieve the most.
Can we submit the report to the BSI?+
The report is written for your internal decisions and makes no legally binding statements. Apart from operators of critical facilities (Section 39), entities only have to provide evidence when the BSI orders it; what counts then is mainly your own documentation and the evidence of implemented measures. The action catalogue from the analysis helps you build it up.
Read more
- NIS2 compliance in Germany: implementation for mid-sized firms
- Section 30 BSIG: the ten NIS2 measures, with a checklist
- NIS2 implementation plan: steps, sequence and a sample plan
- NIS2 and ISO 27001 in Germany: mapping, differences, gaps
- NIS2 applicability in Germany: Section 28 BSIG scope check
- NIS2 registration in Germany: BSI portal, deadline and data
- NIS2 incident reporting in Germany: Section 32 BSIG deadlines
- NIS2 management obligations: Section 38 BSIG and liability
- NIS2 supply chain security: assessing service providers
- NIS2 management training: in-house under Section 38 BSIG
- About NIS2-Readiness: Blackfort Technology, Bonn, Germany
Sources
- Section 30 BSIG: risk management measures (German) (retrieved 2026-11-06)
- BSI: one-pager NIS‑2 and ISO 27001, version 1.0 (PDF, German) (retrieved 2026-11-06)
- BSI: general FAQ on NIS‑2 (German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Request a gap analysis
Tell us briefly which sector you are in, how large your organisation is and who runs your IT. In the scoping call, by phone or video, we choose the right tier. No commitment up front.