NIS2 assessment
Know where you stand. Decide what is needed now.
An independent assessment identifies risks and opportunities, and shows which measures and evidence need attention. You’ll receive an evidence-based picture and practical priorities, not an abstract checklist.
Dutch Cybersecurity Act in force
The Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements NIS2, has been in force since 15 August 2026. Organisations must determine whether they fall within its scope. The assessment can also cover national NIS2 requirements in other countries. We agree in advance which countries, requirements and parts of your organisation will be assessed.
The outcome
A basis for decision-making by management and IT
After the assessment, you will understand the main gaps, why they matter and which improvements deserve attention first.
Executive summary
The main risks, opportunities, conclusions and choices in clear language for decision-makers.
Evidence-based findings
A clear overview of the topics assessed, existing measures, evidence and relevant gaps.
Practical roadmap
Prioritised improvement actions in a realistic sequence, so you can move forward with focus. A comprehensive strategic plan with a vision and target IT setup can be developed as a separate next step within the Direction phase.
Topics
What we assess
The scope is agreed in advance to match your organisation, sector, size, services and risk profile.
- governance, responsibilities and risk management
- information security policy and incident handling
- business continuity, backups and recovery
- supply chain and supplier security
- access management, assets and vulnerabilities
- security in acquisition, development and maintenance
- awareness, cyber hygiene and training
- evidence, registration and reporting processes
Important: the Dutch NCSC describes ten categories of measures for the duty of care, based on risk management. Which measures are appropriate and proportionate depends on the organisation. Read the NCSC’s official explanation (in Dutch).
Approach
Thorough, transparent and together with your organisation
We base our conclusions on documentation, interviews and other relevant evidence. Draft findings are validated with your organisation before the report is finalised.
Guided Control remains independent in its advice. Your organisation or specialist partners carry out implementation; we can guide and monitor progress.
- Initial discussion and scopeDefine the drivers, objectives, context and boundaries.
- Gather evidenceGather documentation and relevant evidence, and conduct interviews.
- AnalysisObjectively assess the current situation, risks, opportunities and gaps.
- Quality reviewCheck findings for substantiation, consistency and completeness.
- Client validationCheck facts and missing context together.
- Final report and presentationPresent results, priorities and choices clearly.
When this assessment helps
Common reasons to start
- a client or supply chain partner sets new security requirements;
- management is unsure where the organisation stands;
- evidence and a coherent roadmap are missing;
- an audit, incident or a question from the board highlights the urgency;
- your organisation wants to prepare systematically for regulatory supervision.
Discuss your situation
We explore the background, potential scope and information needed for a suitable proposal.
An assessment is not a certification, legal advice or a guarantee that your organisation is compliant or completely secure.