Readiness check: how prepared is your organisation?
Seven questions, about two minutes. Then you know how well your team is prepared for a cyber attack and what to tackle next, with NIS2, ISO 27001, DORA and TISAX in mind. The check is free, and you do not need to sign up.
Seven short questions on your emergency plan, exercise practice, roles, reporting chain, evaluation, evidence and management, plus one question about your regulatory framework. Then you see your score and where to start.
What does the readiness check measure?
A NIS2 scoping assessment answers the question “Does this apply to us?”. This check goes further: “Are we prepared?”. It rates seven areas: whether there is a written incident response plan, how often you exercise, whether roles and escalation are settled, whether the reporting chain has been rehearsed, whether exercises are evaluated (after-action review), whether there is evidence for the auditor, and whether management is involved.
You get a score and a recommendation for every weak area. You also see which gaps a cyber tabletop exercise closes fastest.
The seven dimensions at a glance
| Dimension | Guiding question |
|---|---|
| Incident response plan | Is there a written plan, and is it up to date? |
| Exercise frequency | When did you last rehearse, and how often do you? |
| Roles and escalation | Does everyone involved know who decides in an emergency? |
| Reporting chain | Have you rehearsed the 24-hour and 72-hour reporting deadlines (NIS2, GDPR)? |
| Evaluation | Is every exercise evaluated in an after-action review? |
| Auditable evidence | Can you show the auditor proof that the exercise took place? |
| Management | Does management take part, and has it been trained? |
Who is the check for?
For everyone who carries responsibility in a cyber crisis: CISOs and IT leads, ISMS and compliance officers who need evidence for NIS2, ISO 27001 or TISAX, incident response and SOC teams, and management teams who want to know where their organisation stands today. The check is especially worthwhile if your organisation, or one of its sites, falls under NIS2. The directive applies across the EU through national transposition laws, and the deadlines for registration and reporting differ by member state.
Why exercise readiness rather than a compliance checklist?
A document is quickly written. Whether the team acts on it in an emergency only shows in an exercise. NIS2 and DORA therefore explicitly require you to assess the effectiveness of your measures and to keep operating during a crisis. So the check goes beyond asking whether a policy exists. It asks whether it has been rehearsed, whether the reporting chain works under time pressure and whether there is evidence of it. Repeat the check every six to twelve months. Then you see how your score develops and can show that to management as well.
What happens after the check?
You see your score immediately and without signing up. For every area with a gap there is a concrete recommendation, from the incident response plan to a first facilitated exercise. A first documented tabletop exercise improves three areas at once: you have rehearsed, the exercise is evaluated, and you have evidence.
Frequently asked questions
What is the readiness check?
A free self-assessment with seven questions. It shows how well your organisation is prepared for a cyber crisis: from the emergency plan to exercise practice to the evidence you can present to the auditor.
How long does the check take?
About two minutes. You see your score and the recommendations straight away. If you wish, we also send you the detailed result by email.
Is the check free and without obligation?
Yes. The check costs nothing, and you see the result without signing up. You only enter contact details if you want the detailed result by email.
Does the check replace a NIS2 scoping assessment?
No, it complements it. The scoping assessment settles whether NIS2 applies to you. The readiness check shows how well you are prepared for a serious incident. Together you know what is required and where you stand today.
How is the score calculated?
Each answer earns points. We convert the total to a scale from 0 to 100 and assign it to one of four levels: “Significant action needed”, “On the way”, “Well positioned” or “Crisis-proof”. For every area where you do not reach the full score, you get a recommendation.