Incident help

Compliance

NIS2 and DORA gap analysis: find out what is missing

DC9 Cyber compares your organisation’s security with the requirements of the NIS2 Directive and the DORA Regulation, identifies the gaps and helps close them — from documentation to technical testing and incident reporting exercises.

Ask about a gap analysis

Who it applies to

Directive (EU) 2022/2555

NIS2

Essential and important entities in 18 sectors — including energy, transport, banking, health, water, digital infrastructure, public administration, manufacturing, food, postal and digital services. In Poland, the amended National Cybersecurity System Act (KSC) entered into force on 3 April 2026; obligations have separate deadlines: registration by 3 October 2026, implementing measures by 3 April 2027, first audit of essential entities by 3 April 2028.

Regulation (EU) 2022/2554

DORA

The financial sector: banks, insurers, investment firms, payment institutions and other financial entities, and indirectly their ICT service providers. Applicable since 17 January 2025.

What we check

Our reference point is the ten areas of risk-management measures in Article 21 of NIS2 and, for the financial sector, the five pillars of DORA.

  • risk analysis and information system security policies
  • incident handling and reporting procedures
  • business continuity: backups, recovery and crisis management
  • supply chain and ICT provider security
  • secure acquisition, development and maintenance of systems, vulnerability handling
  • assessing the effectiveness of measures and resilience testing
  • cyber hygiene and training — including for the management body, which approves the measures
  • cryptography, access control, asset management and multi-factor authentication

Incident reporting deadlines — two different regimes

significant incident

NIS2 / Polish KSC Act

  1. early warning — within 24 hours of becoming aware
  2. incident notification — within 72 hours of becoming aware
  3. final report — within one month of the notification

Based on Article 23 of NIS2; national law sets details for specific entity types.

major ICT-related incident

DORA

  1. initial notification — within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it
  2. intermediate report — within 72 hours of the initial notification
  3. final report — within one month of the latest intermediate report

Commission Delegated Regulation (EU) 2025/301, Article 5.

How the gap analysis works

  1. Scope and qualification

    We establish whether and as what type of entity your organisation falls under NIS2 or DORA, and which systems and processes the analysis covers.

  2. Review and interviews

    We analyse documentation, talk to IT, security and management, and check how processes work in practice.

  3. Technical verification

    Where needed, we confirm the actual state with testing and configuration reviews, and test response procedures with a tabletop exercise.

  4. Report and plan

    We deliver a list of gaps with priorities and an action plan that can be implemented in stages.

What you get

  • a gap report against NIS2 (and national law) or DORA, with risk assessment and priorities
  • an action plan split into quick wins and long-term changes
  • an incident reporting procedure aligned with the applicable regime and its deadlines
  • a briefing for the board: what to approve, what it is accountable for and where to start
  • optional implementation support: testing, training, exercises and technical debt remediation
Ask about a gap analysis

Frequently asked questions

How do we know if we fall under NIS2?

It depends on the sector and usually on company size, and in some sectors on the entity’s role alone. We carry out the qualification at the start of the analysis, based on the national law transposing the directive.

Is the board accountable for cybersecurity?

Yes. NIS2 requires management bodies to approve risk-management measures, oversee their implementation and follow training. That is why the analysis includes a briefing for the board.

How is a gap analysis different from an audit?

A gap analysis shows the difference between the current state and the requirements, and a plan to reach compliance. It is not a certification — it prepares the organisation for implementation and possible supervision.

Do you also help with implementation?

Yes. After the analysis we can run penetration tests, tabletop exercises on incident reporting and training, and help eliminate technical debt.