Free · no registration
NIS2 tool
Find out whether NIS2 applies to your company, assess your readiness and build an action plan. Plus a calculator for the incident reporting deadlines. Everything runs in your browser.
Does NIS2 apply to your company?
Three questions about your sector and size. You get an indicative view of whether you are an essential or important entity, or outside the scope.
Essential entity
NIS2 most likely applies to your company as an essential entity
Essential entities are supervised proactively, and their obligations are the widest. Register with the supervisory authority and start with the risk management measures.
Important entity
NIS2 most likely applies to your company as an important entity
Important entities have the same risk management and reporting obligations as essential ones, but supervision is mostly after the fact, for example following an incident or a tip-off.
Below the size threshold
Your company is most likely below the size threshold
NIS2 mostly applies to companies that are at least medium-sized. A smaller company can still be covered, for example if it is the only provider in its sector. Customers covered by NIS2 may also require the same things from their suppliers.
Not directly
NIS2 most likely does not apply to your company directly
Your sector is not in the NIS2 annexes. If your customers are covered by NIS2, they still have to assess their suppliers, so it pays to have the same basics in order too.
Let’s check together
Your sector needs a closer look
The NIS2 sector definitions are detailed. Let’s go through the annexes together, so you know for sure whether the law applies to you and what it requires.
Your customers are covered by NIS2. They have to make sure their supply chain is secure, so be ready for questionnaires, contract requirements and audits.
What it means in practice
- Register with the supervisory authority for your sector.
- Put the risk management measures in place (NIS2 Article 21): risk assessment, incident handling, continuity, supply chain, cyber hygiene, encryption, access control and multi-factor authentication.
- Report significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
- Management approves the measures, oversees them and takes training. Management can be held liable for neglect.
- The administrative fine can be up to €10 million or 2% of turnover for an essential entity, and up to €7 million or 1.4% for an important one.
In Finland, NIS2 was implemented by the Cybersecurity Act, which came into force in April 2025. The result is indicative and does not replace a legal assessment or the supervisory authority’s view.
How ready is your company?
Two questions for each area of NIS2. You get your readiness as a percentage per area and a list of gaps that becomes your action plan.
Action plan
The gaps from the readiness check became a list. Add the owner, due date and status. The details are saved only in this browser.
Do the readiness check first, and the action list appears here.
Your readiness
0 %
NIS2 assessment:
Every area is in order. Well done! Make sure it stays up to date.
Actions in order of importance
-
Management responsibility
Take the risk assessment and action plan to management for approval, and agree how often management reviews the situation, for example quarterly.
-
Management responsibility
Arrange a short training for management on the NIS2 obligations, management’s responsibility and the company’s main risks.
-
Risk management and policies
Do a risk assessment: list your key services and data, the threats to them, and their likelihood and impact. Update it at least once a year.
-
Risk management and policies
Write down the information security policy: goals, responsibilities and principles. A ready-made template speeds things up.
-
Incident handling
Write an incident procedure: who decides, who to call, how to isolate a system and how events are documented.
-
Incident handling
Set up logging and alerts for your key systems, for example the built-in alerts in Microsoft 365.
-
Incident reporting
Write down the reporting chain and the authority’s contact details: early warning within 24 hours, incident notification within 72 hours and final report within one month.
-
Incident reporting
Hold a yearly tabletop exercise that walks an imagined incident from detection to the final report.
-
Continuity and backups
Back up your cloud services too, keep one copy separate and test restoring regularly.
-
Continuity and backups
Write down how your key services are restored and who leads in a crisis. Keep the plan available even when systems are down.
-
Supply chain security
List the suppliers whose failure would stop your business, and assess their security, for example with a questionnaire.
-
Supply chain security
Add a security annex to your contracts: minimum requirements, incident reporting and the right to audit.
-
Acquisition, development and vulnerabilities
Turn on automatic updates and agree how quickly critical vulnerabilities are fixed.
-
Acquisition, development and vulnerabilities
Add security requirements to your purchasing checklist: authentication, logs, data location and updates.
-
Assessing effectiveness
Set up a yearly calendar: when the measures are reviewed, who assesses them and how findings are fixed.
-
Assessing effectiveness
Choose a few metrics, for example update coverage, multi-factor authentication use and the share of staff who have completed training.
-
Cyber hygiene and training
Hold regular training and practise spotting scam messages.
-
Cyber hygiene and training
Write short instructions for staff and go through them during onboarding.
-
Encryption
Turn on disk encryption on every device and make sure your services use encrypted connections.
-
Encryption
Write down what is encrypted, with which methods, and who manages keys and recovery keys.
-
HR security, access control and assets
List your systems and users, give rights as needed and review them regularly.
-
HR security, access control and assets
Build a list of devices and systems with their owners, and keep it current.
-
Multi-factor authentication and communications
Turn on multi-factor authentication everywhere that can be reached from the internet, especially for admin accounts.
-
Multi-factor authentication and communications
Agree on a backup channel and keep the key contact details outside your systems too.
Show the result by area
The tool runs entirely in your browser. Your answers and plan are not sent to Foregon or anyone else: they are saved only in this browser until you clear them.
Incident reporting deadlines
Enter the moment a significant incident was detected. The tool works out the NIS2 deadlines.
- Early warning – within 24 hours of detection
- Incident notification – within 72 hours of detection
- Final report – within one month of the incident notification
Reports go to the supervisory authority for your sector. If the incident is still ongoing when the final report would be due, a progress report is given, and the final report within one month of the incident being handled.