Gap check · NIS2 and KRITIS

Where does your security really stand?

A free assessment across 15 security capability domains: 30 questions in the compact run or 61 in full, then the maturity per domain with its confidence, quick wins for 30/60/90 days and the derived status against ISO/IEC 27001, IEC 62443 and KRITIS. The scoring runs in your browser.

NIS2 Gap CheckSet the scope

Four questions to set the scope, then we begin. Your browser does the scoring itself: clicks on the answer cards are not sent anywhere or stored anywhere, and reloading the page clears your progress.

If you answer in your own words

Typed text is sent to a language model, which matches it to one of the three answer cards. Only the current question, its three cards and your text are sent, not your result and not your other answers. Providers that may store inputs are excluded. Clicking a card sends nothing at all.

Please do not enter personal data or confidential details. The questions are about processes, never about the content of a piece of evidence.

We store nothing unless you choose to send us your result at the end. Details are in our privacy policy.

K1 · Your role

This weights how reliable your answer is for each domain. Nobody can judge everything; that is built into the scoring and is no shortcoming.

K2 · KRITIS operator under the BSIG (German BSI Act)

Without operator status, the BSIG obligations are left out and do not count as a gap.

K3 · OT, production or control systems in use

Without OT, the IEC 62443 requirements do not count towards the scoring.

K4 · Existing certifications or audits

Valid evidence raises the confidence of the analysis in the domains it covers. Select all that apply.

Compact asks two questions per domain: the one with the widest control coverage and one that opens up further scoring dimensions. About fifteen minutes. Full covers the whole catalogue and noticeably raises the confidence.