NIS 2 maturity · Mandatory EU directive
Your NIS 2 obligations, measured theme by theme and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
NIS 2 maturity · Mandatory EU directive
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One Directive (EU) 2022/2555, known as NIS 2 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, a level, the level above, and the action linking the two, is what turns an observation into a trajectory.
Does the incident notification process allow the 24 hour early warning deadline to the competent authority to be met?
- N1
No notification procedure. The reporting channel to the authority and the expected content are not identified.
- N2
A procedure exists on paper. Trigger criteria remain vague and no one has been designated to issue the notification outside working hours.
- N3
Qualification criteria are defined, a notification role is designated with a backup, and the channel to the authority has been tested at least once.
- N4
Notification is built into the on-call chain, the 24 hour, 72 hour and one month deadlines are tracked as indicators, and every notification is logged with timestamps.
- N5
The process is proven through exercises including night time and weekend scenarios, and revised after each exercise or real incident, with documented tracking of revisions.
Action to move from L2 to L3
Write the qualification criteria for a significant incident, designate a notification issuer and a backup in the on-call rota, then test the reporting channel to the authority during the next crisis exercise.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon NIS 2.
What this framework covers
Directive (EU) 2022/2555, known as NIS 2, replaces the 2016 NIS directive and considerably widens the number of entities in scope. It distinguishes essential entities and important entities, spread across 18 sectors, from energy to healthcare, transport to digital infrastructure, including waste management and the manufacture of critical products. Its Article 21 lists 10 categories of risk management measures: risk analysis, incident handling, business continuity, supply chain security, security in the acquisition and maintenance of systems, effectiveness assessment, basic cyber hygiene and training, cryptography, access control and asset management, multi-factor authentication. Article 20 makes management bodies accountable, requiring them to approve the measures and undergo training.
The difficulty is not reading the text, it is knowing where you actually stand. The directive sets objectives rather than detailed technical requirements, leaving national transpositions to fill in the detail. The same practical questions come up everywhere: is the supply chain genuinely covered, or only the IT suppliers already under contract? Does the notification process actually meet the 24 hour early warning deadline, weekends included? Has the management body formally approved the measures, with a usable record of it? These answers cannot be deduced from a tool inventory.
One common confusion is worth clearing up: NIS 2 cannot be certified. No body issues a NIS 2 certificate. Oversight sits with the competent national authorities, in France the ANSSI, with a stricter supervisory regime for essential entities than for important entities. Another frequent misunderstanding: scope is not determined by size alone, some entities are designated regardless of headcount. Finally, national transpositions have not all been adopted at the same pace, which does not remove the obligation to prepare for groups operating across several member states.
A maturity assessment answers a different question from a compliance audit. An audit concludes with compliant or non compliant, at a given date. The assessment places each practice on a progressive scale and points to the specific action that moves it up a level. On a text that leaves room for interpretation to the authorities, this level based reading is more useful than a binary verdict: it demonstrates a trajectory, supports investment decisions and allows entities within the same group to be compared.
Within Datamensio, the NIS 2 framework is ready to use. You can also adapt it to your context: the AI adjusts the themes, questions and levels according to the CMMI method, or builds a sector specific version from your own documents, security policy, continuity plan or the requirements set by your national transposition.
Reference standard: Directive (EU) 2022/2555, known as NIS 2
The themes assessed
Scope and governance
Qualification as an essential or important entity, registration with the national authority, roles and responsibilities, approval of measures by the management body, training of leadership.
Risk analysis and security policy
Formalised and approved policy, risk assessment method, coverage, acceptance criteria, frequency of reassessment.
Incident management
Detection and qualification, handling procedures, logging, lessons learned, coordination with operational teams.
Notification to authorities
Early warning process within 24 hours, notification within 72 hours, final report within one month, informing service recipients, on-call arrangements and decision chain.
Business continuity and crisis management
Backups and tested restoration, business continuity and disaster recovery plans, crisis management, exercises and ransomware scenarios.
Supply chain security
Mapping of critical suppliers and providers, contractual security clauses, third party assessment, management of vulnerabilities passed on through the chain.
Acquisition, development and maintenance
Security throughout the system lifecycle, patch management, vulnerability disclosure and handling, testing and release into production.
Access control and asset management
Asset inventory, privileged account management, access reviews, multi-factor authentication, secure emergency communications.
Cryptography and data protection
Encryption policy, key management, encryption of data at rest and in transit, use of protocols.
Cyber hygiene, training and effectiveness assessment
Awareness programme, basic hygiene practices, indicators, internal audits, measuring the effectiveness of risk management measures.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Can NIS 2 be certified?
No. No body issues a NIS 2 certificate. Oversight sits with the competent national authorities, with a supervisory regime that differs depending on whether the entity is essential or important. The maturity assessment is used to demonstrate a documented trajectory, not to obtain a label.
What is the difference between this assessment and a NIS 2 compliance audit?
An audit checks whether requirements are met at a given date and concludes with a gap. The assessment places each practice on five levels and points to the action that moves it up a level. The two are complementary: the assessment prepares and prioritises, the audit validates.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete. The full version, run collaboratively with several contributors, generally spans one to two weeks, most of the time being spent gathering input from the security, procurement and continuity teams.
We are already ISO 27001 certified, do we need to run an assessment as well?
ISO 27001 covers much of Article 21, but not all of it. Notification to authorities within the mandated deadlines, the accountability of the management body and the level of rigour expected on the supply chain call for specific review. The assessment identifies this delta rather than reassessing everything.
Can the framework be adapted to our sector or our national transposition?
Yes. You can change the questions, the levels, add your own themes or start from a blank slate. The AI can also build a version from your documents, for example the requirements set out by your national authority. You retain full control of the framework.
How do we compare several entities within the same group?
Each business unit runs its assessment against the same framework, which makes the scores comparable theme by theme. A cross-entity roadmap consolidates the action plans and merges redundant actions, rather than handling them entity by entity.
Is the action plan costed?
Every gap between the score and the target generates an action. The catalogue of services matches a solution to each action, with its cost, timeline and expected impact on the score. The AI then groups these actions into a prioritised roadmap.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.