Self-control assessment (NIS2)

1. Organisational controls - Governance and risk context (CIS2 Article 20)

Critical services and their dependence - systems, data, suppliers and people - have been identifiedRisk: without it, the protection is distributed equally and the most important remains as weak as the minor.Verification: each critical service has an owner and an addictive card.Proof: list of services and addictions.NIS2: 21(1).
The main threat scenarios are assessed by likelihood and impactE.g. spying virus, account take-over, supplier compromise, leak, failure.Risk: controls are selected by habit, not by threat.Verification: for each scenario it is known which controls reduce it.Proof: scenario assessment and threat information sources.NIS2: 21(1).
Management has approved which residual risks may be accepted by the organisationRisk: without risk appetite there is no criterion, the deficiency of which must be corrected immediately and which can be expected.Verification: the appetite is clearly understandable - for example, the permissible idle time and data loss.Proof: management decision.NIS2: article 20.
Determined whether an organisation is a substantial or important entity, and whyThe requirements for providers of cloud, data centres and managed services are specified in Implementing Regulation (EU) 2024/2690.Risk: incorrect classification means incorrect supervisory regime and the scope of requirements.Verification: compare the sector and size with Annexes I and II to the NIS2.Proof: a dated assessment.NIS2: article 3.
The organisation is registered with the supervising body if requiredRisk: the unregistered entity does not receive supervisory information and risks sanctions.Verification: the registration data match current contacts.Proof: confirmation of registration.NIS2: article 3.
The scope and depth of the assessment are identified by riskHigh risk areas shall be checked by sampling and testing, low risk by document review.Risk: equal depth spends time on low risk areas everywhere and does not notice high risk gaps.Verification: the scope shows what is outside it and why.Proof: description of the coverage.NIS2: 21(1).
Management has approved cybersecurity risk management measures and is responsible for their enforcementRisk: measures without a management decision receive no resources.Verification: the decision contains measures, budgets and responsible, not just policy.Proof: management decision or protocol.NIS2: article 20.
Management at least once a year reviews major risks and implementation of measuresRisk: the management becomes aware of the risk only at the moment of the incident.Verification: the protocols contain decisions on specific risks, not just information.Proof: management reports and minutes.NIS2: article 20.
The person responsible for cyber security has authority and direct access to managementRisk: no mandate can be given.Verification: the description of the position has the right to suspend a risky change or escalate to the management.Proof: the order or description of the post.NIS2: article 20.

2. Organisational controls - risk management, policies and assets

Risk assessment methodology produces comparable resultsA common scale of feasibility and impact, expressed in terms of service, financial and personal data.Risk: different evaluators give incomparable assessments.Verification: two similar risks were assessed in the same way in the register.Proof: methodology and last evaluation.NIS2: 21(2)(a).
The risk register is current and each risk has its owner and residual risk assessmentThe approach to all threats - including physical and environmental threats, not just attacks.Risk: a register, which nobody renews, shows the past.Verification: the risks of recent incidents and material changes are in the registry.Proof: a register with owners and the date of the change.NIS2: 21(2)(a).
The risk treatment plan is arranged according to the size of the risk, with the responsible and timelinesRisk: the simplest, not the most important.Verification: the highest risks in the plan are first and with the nearest deadlines.Proof: risk management plan and performance status.NIS2: 21(2)(a).
Risks are revalued regularly and after significant changes or incidentsRisk: a new system or supplier enters without a risk assessment.Verification: the sample shall include the last material change and check whether it has an assessment.Proof: review records.NIS2: 21(2)(a).
Security policy is validated, current and reflects the organisation's main risksRisk: general policy changes nothing from the template in practice.Verification: policy requirements respond to threat scenarios.Proof: policy with version and review date.NIS2: 21(2)(a).
The asset register shall cover equipment, software, data and servicesRisk: that which is not listed cannot be protected or monitored.Verification: compare the register with the result of a network scan.Proof: register with owners and decline.NIS2: 21 (2) (i).
Access is granted on the basis of minimum rights and labour needsRisk: extensive rights increase the impact of an account transfer.Verification: in the sample, users' rights correspond to their role.Proof: access policy and role-rights matrix.NIS2: 21 (2) (i).
Access rights are reviewed, more frequent for critical systemsRisk: the rights accrue as posts change.Verification: rights have been withdrawn in the last revision: a review without any withdrawal is often formal.Proof: review record.NIS2: 21 (2) (i).

3. Organisational controls - supply chain

Suppliers are arranged according to risk - access, data and service degradationRisk: all suppliers are checked equally and the most critical remain unsupervised.Verification: the list shows who has access to the systems or data.Proof: list of suppliers with a decline.NIS2: 21(2)(d).
Critical suppliers have security requirements in their contractsNotification of incidents, access control, subcontractors, audit rights.Risk: find out the supplier's incident from the news.Verification: a sample of critical suppliers' contracts.Proof: annexes to contracts.NIS2: 21(2)(d).
Critical suppliers are assessed for safety before the contract and periodicallyRisk: the weakness of the supplier becomes your entry point.Verification: the depth of assessment is in line with the supplier's criticalness.Proof: the results of questionnaires, certificates or checks.NIS2: 21(2)(d).
Access to suppliers is restricted, supervised and timely withdrawnRisk: a supplier's account with extensive rights remains active for years.Verification: compare active suppliers' accounts with existing contracts.Proof: list of access and date of review.NIS2: 21(2)(d).
Assessment of the significance of a critical supplier's compromise or interruptionRisk: the failure of one cloud or software supplier shall stop the entire operation.Verification: critical suppliers have an action plan or alternative.Proof: assessment and exit plan.NIS2: 21 (2) (d), 21 (2) (c).

4. Organisational controls - Incidents and reporting (NIS2 Article 23)

5. Organisational controls - business continuity and crises

Critical services have allowed idle time and data lossUpdate time (RTO) and permissible data loss (RPO).Risk: copies and plans do not match how long a business can wait.Verification: the objectives have been validated by the service owner.Proof: impact analysis.NIS2: 21(2)(c).
Emergency recovery plan is also tried and available without affected systemsRisk: the plan is located in the same system that is not available.Verification: plan and contacts are available offline.Proof: plan and date of the last test.NIS2: 21(2)(c).
Crisis management arrangements and decision-makers are defined, including substitutesRisk: it is unclear who decides to exclude systems or to communicate with the public.Verification: each role has a substitute.Proof: the composition and composition of the crisis team.NIS2: 21(2)(c).
The emergency communication channel shall be operational even if the basic systems are not availableFor example, if email is compromised.Risk: the crisis team cannot communicate or communicate with the attacker.Verification: canal tried on exercise.Proof: description of the channel and date of inspection.NIS2: 21 (2) (j).

6. Organisational controls - evaluation of effectiveness

The effectiveness of measures shall be measured by indicators relating to key risksFor example, critical vulnerability prevention time, phishing test results, renewal time.Risk: measure what is easily counted, not what reduces the risk.Verification: each indicator has a target.Proof: values of indicators over time.NIS2: 21 (2) (f).
High risk controls have proven performance throughout the period, not only existenceDocumented controls may not work in practice.Risk: policy exists, but access has not been reviewed year.Verification: sample from several months of the period, re-performance or observation.Proof: the inspection working documents.NIS2: 21 (2) (f).
Internal audit or independent review covers the highest risk areasRisk: the audit examines the comfortable, not risky.Verification: the audit plan is linked to a risk record.Proof: audit plan, report and status of findings.NIS2: 21 (2) (f).
Technical tests, e.g. intrusion test, cover critical services, and findings have been eliminatedRisk: the test involves a minor system but the critical remains untested.Verification: the scope of the test and the re-examination after correction.Proof: test report and prevention plan.NIS2: 21 (2) (f).
Non-compliances are resolved without undue delay starting with the highest riskRisk: findings accumulate.Verification: the number and age of late corrective actions.Proof: a list of corrective actions.NIS2: 21(4).

7. Personnel controls

Security steps in recruitment and departure are completed, access is withdrawn on departureRisk: the account of the former staff member remains active.Verification: compare outgoing employees to active accounts in the sample.Proof: the checklist and the final cases.NIS2: 21 (2) (i).
Employment contracts and confidentiality obligations are security obligationsRisk: the staff member does not know what to do with the data and the infringement has no consequences.Verification: the sample has security obligations and confidentiality in the latest contracts.Proof: contract template and signed commitments.NIS2: 21 (2) (i).
Management members are trained in cybersecurity risk managementRisk: management is unable to assess whether the measures are appropriate to the risk.Verification: the training addresses the organisation's own risks, not just the general theory.Proof: training records.NIS2: article 20.
All staff are trained before and regularly thereafterRisk: the person is the most frequent entry point.Verification: the sample of young workers was trained before access.Proof: training records.NIS2: 21 (2) (g).
Staff recognize and report phishingRisk: account take-over and payment fraud.Verification: reporting rate in simulations, not just in clicks.Proof: results of simulations.NIS2: 21 (2) (g).
Additional training at increased riskAdministrators, developers, financial employees.Risk: the impact of one error in these roles is greatest.Verification: the content of the training meets the threat of a role.Proof: role training plan.NIS2: 21 (2) (g).
Employees know how to report a security event and do so without fear of consequencesRisk: errors and suspicions are hidden until they become an incident.Verification: the number of messages is not zero - zero usually means that neither is reported nor is anything happening.Proof: reporting channel and message log.NIS2: 21 (2) (b).
Safety conditions for remote workRisk: the home network and shared devices become an entry into the organisation systems.Verification: remote access is only possible from managed devices or with additional controls.Proof: remote working order and access configuration.NIS2: 21 (2) (g).

8. Technological controls - identity, equipment, network and cryptographic

9. Technological controls - development, vulnerability, monitoring and copies

Security requirements are established before the system is purchased or developedRisk: security is added later - more expensive and incomplete.Verification: the sample has security requirements in recent procurements or projects.Proof: a list of requirements.NIS2: 21 (2) (e).
Prevention of injury within time limits depending on riskCritical and actively used - days, not months.Risk: known vulnerability remains open until used.Verification: how much of the criticality in the last quarter has been removed by the deadline.Proof: scanning reports.NIS2: 21 (2) (e).
Security updates are installed from systems available on the InternetRisk: the outer surface shall remain unstuffed until the internal systems are in order.Verification: update status of external systems.Proof: update report.NIS2: 21 (2) (e).
Changes to critical systems are assessed, harmonised and reversibleRisk: an unverified change causes a downtime or opens a new hole.Verification: the last change in the sample is approved and the return plan.Proof: requests for changes.NIS2: 21 (2) (e).
There are public procedures for reporting on vulnerabilities foundNIS2 requires vulnerability handling and detection.Risk: the researcher who finds a hole does not know who to report.Verification: contact is running and the answer comes at a certain time.Proof: security.txt or a page with contact.NIS2: 21 (2) (e).
Systems have a secure base configuration, and deviations are listedRisk: default passwords and unnecessary services.Verification: compare some systems to the standard in the sample.Proof: configuration standard and list of derogations.NIS2: 21 (2) (e).
Security events of critical systems are monitored, and alarms by someone examineRisk: intrusion shall be detected months later or not at all.Verification: take a few last alarms and a check, which and how quickly they were examined.Proof: log sources, storage period, alarm records.NIS2: 21 (2) (b).
Backup of critical systems is protected from the same attack affecting the working environmentOffline or non-variable, with individual access data.Risk: the print virus also destroys copies.Verification: whether copies may be deleted from the administrator account in the working environment.Proof: copy architecture and graph.NIS2: 21(2)(c).
The renewal has been verified within the last 12 months and falls within the prescribed time limitA copy that has not been renewed has not been verified.Risk: copy is, but renewal lasts weeks.Verification: the duration of the renewal has been compared to the permissible idle time.Proof: test report.NIS2: 21(2)(c).

10. Physical controls

Server rooms and network facilities are locked and access to them is listedIf the systems are at the supplier's data centre, check his certifications.Risk: physical access to circumvent technical controls.Verification: compare the access list with those who need it for the job.Proof: access list and entry log.NIS2: 21 (1), 21 (2) (i).
Physical access to critical premises is monitoredRisk: the unauthorised entry remains unnoticed.Verification: records are kept for a certain period and shall be reviewed following the event.Proof: description of supervision and storage life.NIS2: 21(1).
Equipment shall be protected against fire, water, overheating and power interruptionRisk: the environmental incident destroys copies of both the system and the same room.Verification: the dates of the continuous feeding and cooling check.Proof: maintenance records.NIS2: 21 (1), 21 (2) (c).
Outside office equipment is protected against loss and theftRisk: lost computer becomes a data leak.Verification: portable devices are encrypted and remotely interlockable.Proof: the device management report.NIS2: 21 (2) (i).
Clean table and blocked screen practices are followedRisk: the visitor or colleague sees what is not for him.Verification: waiting at working time of the sample.Proof: passage record.NIS2: 21 (2) (g).
Data carriers and equipment are safely destroyed or cleaned before transfer or disposalRisk: customer data remains on the computer that has been written off.Verification: the last transferred equipment in the sample has a declaration of destruction.Proof: disposal acts.NIS2: 21 (2) (i).

11. Conclusion of the assessment - residual risk and management decision

Each item is supported by proofRisk: executed without proof is a declaration, neither a control.Verification: the comment indicates where the document is located.Proof: in reference comments.NIS2: 21 (2) (f).
Each point marked "Not applicable' is justifiedRisk: "not applicable' becomes a way of avoiding an uncomfortable point.Verification: the justification may be verified.Proof: reason for comment.NIS2: 21(1).
Each deficiency is assessed at residual risk and its ownerRisk: without a risk assessment it cannot be decided which is to be corrected first.Verification: the valuation shall use the same methodology as the risk register.Proof: a list of deficiencies with a risk assessment.NIS2: 21(1).
The improvement plan shall be arranged according to residual risk, responsible and dueRisk: first corrects the simplest.Verification: the highest risk gaps are at the beginning of the plan.Proof: improvement plan.NIS2: 21(4).
The residual risk over appetite management has accepted or ordered to reduce in writingRisk: the risk remains, but no one has decided on it.Verification: each such risk has a decision with a date and a review deadline.Proof: management decision.NIS2: article 20.
The results have been submitted to the management and the management is familiar with themRisk: assessment remains in the IT folder.Verification: management receives a summary of the highest risks, not only score.Proof: management decision or protocol.NIS2: article 20.
Date of next evaluation is set and high risk areas are reviewed more frequentlyRisk: the assessment is ageing faster than the environment.Verification: the date shall be at least annually in the plan, as well as following significant changes or serious incidents.Proof: the timetable.NIS2: 21 (2) (f).
Evaluation is used as self-control, not as audit or certificationSelf-control does not replace independent audit or certification.Risk: self-assessment is too optimistic.Verification: the highest risk areas are also subject to independent review.Proof: an independent inspection plan.NIS2: 21 (2) (f).