NIS2 compliance is verified through audit. In practice there are three distinct moments: the initial audit (the gap analysis), the internal audit after implementation and the periodic external audit, performed through DNSC-attested auditors. We explain what each one means, what you get and how you prepare.
The initial audit: the gap analysis
The first step is to find out where you stand. The maturity self-assessment on the CyFun framework is what is called in practice the initial audit or gap analysis: you go through the controls on the six CyFun functions (Govern, Identify, Protect, Detect, Respond, Recover) and receive a score that shows the distance from the required level (Basic, Important or Essential).
You can do it yourself, for free, directly in the platform. If you prefer to be assisted, a Certudo consultant performs it together with your team, as an assisted gap analysis, and builds the implementation plan.
The internal audit, after implementation
Once you have put the measures from the plan into practice, the internal audit verifies that they really work: policies applied, evidence collected, registers up to date, incidents handled according to the procedures. Unlike the initial audit, here you no longer measure the gap, but confirm the coverage of the controls and the maintenance of the maturity level.
The external audit, through DNSC-attested auditors
The external audit is performed by DNSC-attested cyber security auditors. Certudo is not authorised as an auditor; our role is to bring you prepared to the audit, through the platform, free tools and consultancy, and the audit itself is performed by attested auditors in-team and from the partner network.
What you get
- A clear picture of your maturity level, on each CyFun function
- An implementation plan prioritised to your risk context
- The evidence and registers needed to support compliance
- The self-assessment and risk reports, prepared for DNSC
The steps in brief
- Classification. You check whether you fall under NIS2 and at what level. Check your classification, for free.
- Risk analysis. You estimate the disruptive effect following the DNSC methodology. Carry out the risk analysis.
- Initial audit. The CyFun maturity self-assessment, with an implementation plan.
- Implementation and audit. You put the measures into practice, then the internal audit and the periodic external one.
See how everything connects in the path from self-assessment to audit and how you choose a DNSC-attested auditor.
See the consultancy packages Request an offer
Frequently asked questions
What is the initial NIS2 audit?
The initial audit, also called the gap analysis, is the maturity self-assessment on the CyFun framework: it shows you where you stand against the requirements of your level and what is missing. You can do it yourself, for free, in the Certudo platform.
Is Certudo a DNSC-authorised auditor?
The audit is performed by DNSC-attested cyber security auditors, in-team and from the partner network. Certudo provides the platform, the free tools and the consultancy that prepare the organisation for the audit.
How long does a NIS2 audit take?
It depends on the entity level and the current maturity. The initial self-assessment takes a few hours. The assisted and external audits are planned together, depending on the scope of CyFun controls to go through.