NIS2 Framework for Cybersecurity Assessment
In industrial and technical design supply chains, cybersecurity is no longer only an internal IT matter. NIS2, customer requirements and supply chain security expectations require companies to demonstrate how risks are identified, managed and monitored.
The customer needed a practical model for assessing the current state of cybersecurity regularly, understandably and in a way that supports management decision-making.
The goal was not to create a heavy audit model, but a clear, repeatable and participatory way of working that makes observations, responsibilities and development actions visible.
The work helped turn regulatory requirements into concrete questions, assessment areas and follow-up actions.
Key areas
- Structuring NIS2 requirements
- Assessing the current state of cybersecurity
- Risk management operating model
- Management responsibilities and follow-up
- Supply chain security
- Staff security awareness
- Continuity and recovery
- Readiness for audits and customer questionnaires
What was done
The goal was to make cybersecurity a monitored operating model, not a one-off checklist.
A structure was defined to help the company assess the state of cybersecurity across different areas and document observations for further development.
The framework included, among other things:
- assessment of management responsibility and commitment
- identification and assessment of cybersecurity risks
- review of the risk management operating model
- assessment of the effectiveness of security controls
- security principles for communication networks and information systems
- system acquisition, development and vulnerability management
- assessment of supply chain cybersecurity
- asset management and review of critical operations
- personnel security and training
- access management and strong authentication
- incident detection and reporting
- backup, recovery and fallback communication
- physical environment and facility security
The model included an assessment scale that allows observations to be compared over time. This turned cybersecurity into a monitored whole instead of a single one-off assessment.
Technical approach
The work combined a regulation-driven perspective with the practical operating environment. The model was built to support discussions with management, IT and operational personnel.
A key principle was that the state of cybersecurity cannot be assessed only through technical settings. Responsibilities, ways of working, training, documentation, incident management and continuous monitoring must also be included.
The approach was based on three ideas:
- first, understand the current state
- then identify gaps and risks
- finally, define responsible follow-up actions
This makes cybersecurity manageable and measurable.
NIS2
From requirements to practical actions
Risk management
Into a monitored whole
Management
Responsibilities made visible
Follow-up
Progress made measurable
Outcome
The project resulted in an implementation model tailored to the customer’s needs. It can be used for regular assessment, management reporting and planning development actions.
The customer received a practical tool for handling NIS2 and supply chain requirements in a clear and repeatable way. The model helps identify what is already at a good level, what needs improvement and which actions should be prioritised next.
The outcome also supports preparation for audits, customer questionnaires and supplier requirements.