Service status
NIS2 topics assess your own position
7 questions · Your self-assessment · Free
Germany: the questions refer to selected topics under section 30 BSIG. This is a self-assessment, not a technical measurement or a decision on legal scope. It does not assess Austrian, Swiss, UK or other national law.
Your answers stay in this browser. On an explicit language change, they are held briefly in the same tab for a one-use transfer, valid for one minute; there is no continuous autosave or transmission. Privacy when changing language.
Summary of your self-assessment
Germany: the questions refer to selected topics under section 30 BSIG. This is a self-assessment, not a technical measurement or a decision on legal scope. It does not assess Austrian, Swiss, UK or other national law.
The percentage summarises seven answers. It does not confirm legal compliance or check evidence. The Web Security Scanner provides selected external configuration findings as a supplement; these do not form complete evidence of NIS2 compliance.
What you assess here
You assess seven selected aspects yourself. The statutory areas of measures are set out in § 30 BSIG; additional management duties in § 38 BSIG. The examples are not an exhaustive list of duties.
Technical assessment
Automated- (e) Secure systems: Security headers, SSL/TLS, HTTPS configuration
- (f) Effectiveness: Individual reports as a data point for your own assessment
- (h) Cryptography: TLS version, cipher suites, HSTS, DANE
The Web Security Scanner checks selected external findings, not a complete area of measures.
Organisational self-assessment
This tool- (a) Risk analysis: ISMS, security policies, risk assessment
- (b) Incident response: Reporting channels, emergency plans, 24h/72h from awareness of a significant incident where § 32 BSIG applies
- (c) Business continuity: Backup, RTO/RPO, crisis management
- (d) Supply chain: Supplier assessment, third-party risk
- (g) Cyber hygiene: Training, awareness, password policies
- (i) Access control: Role model, permissions
- (j) MFA: Multi-factor authentication for critical systems
Self-assessment: Not in place → Planned → Partial → Implemented in your own assessment
Selected questions and partial technical findings
The overview maps topics to the catalogue of measures. It is not a complete assessment of all ten areas: the questionnaire contains seven selected questions, while separate scanners record individual technical characteristics. Even together, they do not replace risk management or a compliance assessment.
Risk analysis & security policies
QuestionnaireIncident handling
QuestionnaireBusiness continuity & crisis management
QuestionnaireSupply chain security
QuestionnaireSecure development & maintenance
⚡ Web/email/API scannersEffectiveness assessment
⚡ Individual reports as a data pointCyber hygiene & training
QuestionnaireCryptography & encryption
⚡ TLS, HSTS, DANEAccess control & human resources security
QuestionnaireMulti-factor authentication
Questionnaire⚡ = selected partial external findings from separate scanners
Readiness check in 3 steps
From seven self-reported answers to a summary percentage — in a few minutes.
Assess your organisation
Seven questions on selected topics. Assign your situation to one of four levels yourself.
~5 minutes · No registrationGet your readiness score
A percentage of your answers and general suggestions. The page does not verify your information.
Immediate · FreeAdd technical findings
A separate external check can supplement technical questions. Its measurements and your self-assessment are different information and do not produce a combined compliance score.
Free report betaFrequently asked questions about the readiness check
What is the difference between the NIS2 scope check and the readiness check?
The scope check maps confirmed self-reported information to selected German or Austrian rules on size, activity and special cases; unresolved conditions and unsupported jurisdictions remain explicitly distinct. The readiness check summarises seven self-assessments on organisational topics. Neither tool makes a complete legal decision on scope or compliance.
Which self-assessments are collected?
You answer seven selected questions on risk analysis, incident handling, business continuity, supply chains, training, access and MFA. The page uses your answers without checking evidence. The questions do not fully cover even these areas of measures; for example, secure communications and management training are not fully assessed.
What do the 4 maturity levels mean?
The four levels reflect your own assessment of each question: not in place, planned, partly implemented, or in your own assessment implemented and documented. The highest level does not confirm fulfilment of a statutory area of measures.
How is the readiness score calculated?
The seven answers are weighted equally: 0 to 3 points per answer, with the sum divided by 21 and displayed as a rounded percentage. 100% means only that you selected the highest level for all seven questions. The figure is not a NIS2 compliance level or a measured security assessment.
Do I need to register?
No. The self-assessment is free and can be used without registration. The technical report beta can also be used without a mandatory email address.
Am I covered by NIS2 at all?
That cannot be inferred from these seven self-assessments. For Germany, entity type, size criteria, enterprise links and special rules under §§ 28 and 29 BSIG require particular attention. The scope check does not cover these criteria in full.
First: are you covered?
These topics can help you organise IT security even without statutory coverage. A NIS2 duty of your own must be clarified against the actual conditions; the scope check provides limited rule-based guidance using confirmed information.