# How does a small or mid-sized company do a cyber risk assessment for NIS2?

Keep it simple, specific and repeated, rather than large and theoretical. NIS2 asks for policies on risk analysis (Article 21(2)(a)) and an all-hazards approach, so include fire, power failure and human error as well as attacks. A workable method: list the services that keep the business running and the systems, data and suppliers each depends on; for each, describe what could go wrong, how likely it is and what it would cost; note the controls already in place and the gaps; rank the gaps by impact; and agree owners and dates for the top ones with management. One page per critical service is enough to start. Review it yearly and after every incident or major change. NetSenX does not perform the assessment, but its alerts and network map show which risks are actually occurring on your network.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/how-do-smes-do-a-cyber-risk-assessment-for-nis2

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Has my country transposed NIS2 into national law yet?](https://netsenx.com/en/faq/has-my-country-transposed-nis2)
- [Does NIS2 require multi-factor authentication?](https://netsenx.com/en/faq/does-nis2-require-multi-factor-authentication)
- [Does NIS2 require encryption?](https://netsenx.com/en/faq/does-nis2-require-encryption)
- [Does NIS2 require backups and a business continuity plan?](https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity)
- [What does NIS2 say about supply chain security?](https://netsenx.com/en/faq/what-does-nis2-say-about-supply-chain-security)