How does a small or mid-sized company do a cyber risk assessment for NIS2?

Keep it simple, specific and repeated, rather than large and theoretical. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. asks for policies on risk analysis (Article 21(2)(a)) and an all-hazards approach, so include fire, power failure and human error as well as attacks. A workable method: list the services that keep the business running and the systems, data and suppliers each depends on; for each, describe what could go wrong, how likely it is and what it would cost; note the controls already in place and the gaps; rank the gaps by impact; and agree owners and dates for the top ones with management. One page per critical service is enough to start. Review it yearly and after every incident or major change. NetSenX does not perform the assessment, but its alerts and network map show which risks are actually occurring on your network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics