Generated by SerafinIT Compliance Engine · ENISA-aligned · July 2026 · Sample Report
Acme Manufacturing has established some documented security controls — particularly in physical security and HR — but critical gaps remain in incident response, access control, and supply chain security. As an Important Entity operating medical device manufacturing across three EU member states, the organisation faces both NIS2 obligations and potential MDCG cybersecurity guidance. Immediate action on the critical gaps is required to avoid supervisory exposure.
Defined · Art. 21(2)(a) · Policy on Security of Network and Information Systems
A documented security policy exists and has been approved by management, but it has not been reviewed in over 18 months. NIS2 requires policies to be regularly reviewed — at minimum annually, and following significant operational changes. The policy does not yet reference NIS2 obligations specifically.
Cybersecurity roles and responsibilities are documented and communicated to relevant staff. A named IT manager holds day-to-day security responsibility.
Senior management has not been formally briefed on NIS2 personal liability obligations under Article 20. This represents a governance gap — board sign-off on cybersecurity strategy is a mandatory NIS2 requirement, not best practice.
Managed · Art. 21(2)(a) · Risk Analysis and Treatment
Annual risk assessments are conducted but documentation is inconsistent and a formal risk register does not exist. NIS2 requires a structured, documented risk management process with traceable treatment plans and ownership.
No independent cybersecurity audit has been conducted in the past 3 years. NIS2 Important Entities are subject to reactive supervision — but an audit trail demonstrating proactive risk management will be critical when the competent authority does engage.
Compliance monitoring relies on informal IT staff checks. No defined metrics, KPIs, or escalation procedures for identified risk deviations exist.
Initial — Critical Gap · Art. 21(2)(b) + Art. 23 · Incident Detection, Response & Reporting
No formal Incident Response Plan (IRP) exists. Article 21(2)(b) explicitly mandates documented incident handling procedures. Without a tested IRP, the 24-hour early warning obligation under Article 23 cannot be met — this is the single highest regulatory risk identified in this assessment.
No Incident Response Owner has been named. In the event of a cyberattack, there is no defined escalation chain, no pre-identified national CSIRT contact, and no communication procedure. Recovery would be entirely ad hoc.
Current detection capability consists of basic endpoint antivirus only. There is no centralised logging, no SIEM, and no alerting system. Incidents could remain undetected for days or weeks — making the 24-hour reporting window effectively impossible without automation.
Post-incident reviews are conducted informally after major IT issues. These should be formalised with documented root-cause analysis, remediation tracking, and lessons-learned integration into policy updates.
Defined · Art. 21(2)(c) · BCP & Disaster Recovery
An IT recovery plan exists covering hardware failures but does not address cybersecurity scenarios — ransomware, data breach, or DDoS. Given the 2022 ransomware incident, this is an urgent gap. NIS2 requires BCP to explicitly cover cyber incident scenarios.
Automated daily backups are in place with offsite cloud copies. Restore tests are conducted quarterly. This is a strong foundation — but immutable backups (unmodifiable by ransomware) should be considered as an enhancement.
RTOs and RPOs are defined informally for the ERP system but not for all critical systems. No formal crisis communication procedure exists for external stakeholders (customers, regulators, press).
Initial — Critical Gap · Art. 21(2)(d) · Supply Chain & Third-Party Security
No supplier security assessments have been conducted. The company uses 4 cloud-based suppliers (ERP, CRM, file storage, HR) with direct access to production data. None have been assessed for cybersecurity posture. Article 21(2)(d) requires entities to address security risks in the supply chain — this is among the most enforced NIS2 obligations.
No cybersecurity clauses exist in supplier contracts. None of the 4 key suppliers are contractually required to notify Acme of a security incident. If a supplier is breached and affects Acme's systems, Acme cannot meet its own 24-hour reporting obligation — cascading regulatory exposure.
No supplier security register exists. The company does not have a documented view of which suppliers access which systems, with what level of privilege, and under what contractual conditions.
Managed · Art. 21(2)(e) · Network & Information Systems Security
Monthly scheduled patching occurs but critical patches are sometimes delayed beyond 30 days due to operational constraints. NIS2 best practice requires critical patches within 72 hours, high within 7 days. A formal patch SLA policy should be adopted.
Production floor network (PLCs, industrial controllers) shares the same network segment as corporate IT. A successful ransomware infection in the office could propagate directly to manufacturing equipment — a scenario with both safety and regulatory implications for medical device manufacturing.
Ad hoc vulnerability scanning occurs after incidents. No continuous scanning capability or CVE monitoring is in place. No formal vulnerability disclosure policy exists.
Managed · Art. 21(2)(f) · Assessing Control Effectiveness
No penetration testing has been conducted. The 2022 ransomware incident was the de facto "test" of security controls — and the result was a 3-day outage. Annual penetration testing is the minimum acceptable standard under NIS2 Article 21(2)(f) for Important Entities.
No formal cybersecurity KPIs are defined or reported to management. The board currently has no quantitative basis for judging whether security investments are effective.
Defined · Art. 21(2)(g) · Security Awareness & Training
Annual security awareness training is conducted for all staff. Content is updated and completion tracked. This is a genuine strength — particularly important for a manufacturing environment where staff interact with both IT and OT systems.
A basic password policy exists but is not technically enforced — staff can choose passwords below the minimum standard. A password manager has not been deployed. Technical enforcement is now the expected standard.
No phishing simulations have been conducted. Given that the 2022 ransomware incident likely originated via a phishing email, this is a priority gap to address alongside technical controls.
Managed · Art. 21(2)(h) · Encryption & Key Management
Company laptops are not encrypted. Given that Acme processes patient-adjacent medical device data across 3 EU countries, an unencrypted laptop loss would constitute a simultaneous NIS2 incident and GDPR personal data breach — double regulatory exposure.
All external-facing web services and cloud platforms use HTTPS/TLS. This is confirmed by the use of SAP Business One and Salesforce cloud editions, which enforce TLS by default.
Several internal applications on the LAN communicate over unencrypted HTTP. While internal-only, lateral movement by an attacker could expose these communications. TLS should be enforced end-to-end.
Defined · Art. 21(2)(i) · Human Resources Security
Employment contracts include confidentiality and data protection obligations. Reference checks are conducted for all new hires. Background checks are performed for roles with system administrator access.
Access revocation upon departure takes 3–5 business days. NIS2 best practice — particularly for a company with cloud systems accessible from anywhere — requires same-day or next-day revocation. This should be automated via HR system integration.
Confirmation provided that all known former employees have had access revoked, verified within the last 6 months. This is a positive control — maintain this verification on a quarterly basis going forward.
Initial — Critical Gap · Art. 21(2)(i) · Access Control & Identity Management
No multi-factor authentication (MFA) is implemented on any system. All three cloud platforms (SAP, Salesforce, Dropbox) support MFA but it has not been enabled. Remote access via VPN uses username and password only. Article 21(2)(i) explicitly requires MFA for remote access — this is the most commonly cited enforcement failure in NIS2 inspections to date.
Most users have local administrator rights on their workstations. This means any malware executed by a user runs with full system privileges — significantly amplifying the impact of any successful phishing or social engineering attack.
No formal access rights review has been conducted in 24 months. With staff turnover and role changes, accumulated excessive permissions ("privilege creep") are likely across multiple systems.
Managed · Art. 21(2)(i) · Asset Inventory & Lifecycle
A hardware asset spreadsheet exists but is updated manually and inconsistently. Software assets, SaaS subscriptions, and cloud services are not inventoried. Shadow IT (unauthorised cloud services) is likely given the lack of systematic tracking.
USB drives are used without restriction across the production floor and offices. This is a significant malware introduction and data exfiltration risk — particularly relevant in a manufacturing environment where USB devices are commonly used to transfer machine programs.
No formal data classification scheme exists. Medical device technical documentation, customer data, and internal communications are all stored with equivalent access — no sensitivity labelling or handling rules.
Quantitatively Managed · Art. 21(2)(j) · Physical & Environmental Security
Key card access, visitor logs, CCTV, and a secure server room are all in place and well-maintained. Physical security is the strongest domain in this assessment — a genuine organisational strength.
Full environmental controls operational: UPS, automated fire suppression, climate control, and redundant power. Tested annually. Generator backup planned for next financial year.
Visitor escort procedure exists but enforcement is inconsistent in production areas adjacent to network cabling infrastructure. Standardise the procedure and include it in annual staff refresher training.
Activate MFA immediately on SAP Business One, Salesforce, Dropbox, and VPN for all users. Microsoft Authenticator is free and takes under 2 hours to deploy organisation-wide. This single control would have prevented or significantly limited the 2022 ransomware incident.
Create a documented IRP including: detection triggers, internal escalation chain, CSIRT notification procedure, evidence preservation protocol, and crisis communications template. Name an IRP Owner with defined authority. Test the plan with a tabletop exercise within 60 days.
Migrate all standard users to non-administrator accounts. Create a defined process for temporary elevation when needed. This reduces the blast radius of any successful phishing attack from "full system compromise" to "user-level damage".
Prioritise SAP and Salesforce (highest data access). Include minimum security standards, right-to-audit, and 24-hour incident notification obligation. Without this, a supplier breach makes your own NIS2 reporting obligation impossible to meet.
Isolate PLC and industrial control systems from the office network using a dedicated VLAN and firewall rules. Given the medical device context, this also addresses MDR cybersecurity requirements and protects manufacturing integrity.
Deploy BitLocker on all Windows laptops and FileVault on Macs. Enforce via Group Policy. Given cross-border operations and medical-adjacent data, an unencrypted laptop loss is a simultaneous NIS2 and GDPR breach.
Add ransomware, data breach, and cloud provider outage scenarios to your existing BCP. Define RTOs and RPOs for all critical systems. Update crisis communication procedure to include regulatory notification workflow.
Engage a qualified penetration testing firm. Focus on external attack surface, cloud configuration, and network segmentation effectiveness. Given the 2022 ransomware incident, prioritise email and endpoint attack vectors.
Deploy Group Policy to block or require encryption on USB devices across office workstations. Create an exception process for legitimate production use cases. Communicate the policy change before technical enforcement.
Roll out a password manager (Bitwarden, 1Password, or similar) to all staff. Enforce unique passwords for all business accounts. Conduct phishing simulation within 30 days of deployment to measure baseline awareness.
Assign an owner and target date for each gap. This register serves as your compliance evidence — document every action taken against each item.
| # | Domain | Article 21 | Gap | Severity | Action | Owner | Target |
|---|---|---|---|---|---|---|---|
| 1 | Incident Handling | Art. 21(2)(b) | No IRP. 24h reporting impossible. | critical | Draft IRP, appoint owner, test. | ___________ | 0–30 days |
| 2 | Access Control | Art. 21(2)(i) | No MFA. Admin rights on all users. | critical | Enable MFA. Remove local admin rights. | ___________ | 0–30 days |
| 3 | Supply Chain | Art. 21(2)(d) | No supplier assessments or clauses. | critical | Assess 4 key suppliers. Update contracts. | ___________ | 1–3 months |
| 4 | Cryptography | Art. 21(2)(h) | Laptops unencrypted. Internal HTTP. | high | Enable BitLocker. Enforce TLS internally. | ___________ | 1–3 months |
| 5 | System Security | Art. 21(2)(e) | OT/IT networks shared. Patch SLAs informal. | high | Segment OT network. Define patch SLAs. | ___________ | 1–3 months |
| 6 | Business Continuity | Art. 21(2)(c) | BCP excludes cyber scenarios. | high | Extend BCP. Add ransomware scenarios. | ___________ | 1–3 months |
| 7 | Effectiveness Review | Art. 21(2)(f) | No pentest in 3+ years. No KPIs. | high | Schedule pentest. Define security KPIs. | ___________ | 3–6 months |
| 8 | Risk Management | Art. 21(2)(a) | No risk register. No independent audit. | medium | Build risk register. Plan external audit. | ___________ | 3–6 months |
| 9 | Asset Management | Art. 21(2)(i) | No USB policy. Partial inventory. | medium | Implement USB controls. Build full inventory. | ___________ | 3–6 months |
| 10 | Security Policy | Art. 21(2)(a) | Policy outdated. No board sign-off. | medium | Review policy. Obtain board approval. | ___________ | 3–6 months |
Your report will be based on your actual answers, your sector, your company size, and your evidence notes — making every finding and recommendation specific to your organisation. Free to start. Full report for €690.
Start your free assessment →