The answer depends on more than having cybersecurity tools in place. It requires a clear understanding of your assets, the dependencies between systems, the risks they face, and whether existing security controls actually work.

In our previous article, NIS2. How to identify the gaps your organisation has yet to uncoverwe explored the importance of conducting a structured assessment to identify security gaps and evaluate the effectiveness of existing measures.

But identifying gaps starts with knowing where to look.

Which areas should you assess? Which security controls deserve closer attention? And what questions should you be asking to determine how prepared your organisation really is?

In this article, we explore six key areas to consider when assessing your organisation's cybersecurity posture in the context of NIS2.

1. Critical assets and operational dependencies

The first step is to identify the systems, applications, devices and services that are essential to your organisation's operations.

This assessment should go beyond maintaining an IT asset inventory. It should also consider the operational impact of each asset becoming unavailable.

For example, a centralised authentication system may not directly support your organisation's core business activities, but an outage could prevent employees from accessing multiple critical applications.

Key questions to consider:

• Which systems are essential to maintaining business operations?

• Which business processes depend on those systems?

• Are there critical dependencies on external suppliers or third-party services?

The objective is to understand where a technical failure could escalate into a significant operational disruption.

2. Identity and access management

Knowing who has access to your systems is important. But it is equally important to establish whether those access rights remain appropriate.

Privileged accounts, former employees' credentials and excessive permissions can introduce significant risks when access rights are not regularly reviewed.

Your assessment should examine authentication mechanisms, privilege management, and the procedures used to grant, modify and revoke access.

One essential question: can your organisation demonstrate that access to critical systems is appropriately controlled and regularly reviewed?

3. Vulnerability management and system protection

Having security tools in place does not remove the need for continuous vulnerability assessment.

Outdated systems, insecure configurations and unsupported devices can create exposure points, even within infrastructures that already have established security measures.

It is important to assess how vulnerabilities are identified, classified, prioritised and remediated, taking into account the criticality of the affected assets.

Remediation priorities should not be determined by technical severity alone. They should also reflect the level of exposure and the potential impact on business operations.

4. Incident detection and response

An organisation may have monitoring systems in place and still struggle to detect or respond to an incident quickly enough.

An effective assessment should therefore examine detection capabilities, escalation procedures and clearly defined responsibilities.

It is essential to understand whether the organisation has the mechanisms needed to analyse alerts, identify significant incidents and mobilise the appropriate response teams.

Has your incident response plan been tested under conditions that allow its effectiveness to be assessed?

Simulation exercises can reveal coordination issues, procedural weaknesses, and operational challenges that may not be apparent from documentation alone.

5. Backups, recuperação e continuidade do negócio.

Creating backups is only one part of an effective recovery strategy.

Your organisation should assess whether data can be restored, how long recovery takes and whether critical systems can resume operations within the required timeframes.

This assessment should consider recovery objectives, backup protection and business continuity procedures.

A successfully completed backup does not, by itself, guarantee that business operations can be restored within an acceptable timeframe.

6. Supplier and third-party security

Cybersecurity risks extend beyond your organisation's internal infrastructure.

Cloud providers, technology service providers and partners with access to systems or information can introduce critical dependencies.

Your assessment should consider the risks associated with these relationships, contractual security requirements and your organisation's ability to respond to incidents affecting external services.

If a critical supplier becomes unavailable, does your organisation understand the potential impact and have suitable alternatives in place?

How can you turn your assessment into clear priorities?

Identifying weaknesses is important, but an assessment only delivers real value when its findings support informed decisions.

Once these areas have been reviewed, identified gaps should be evaluated against asset criticality, the likelihood of relevant threats materialising and the potential impact of incidents.

This allows organisations to prioritise remediation activities, assign responsibilities and monitor the effectiveness of implemented measures.

It is equally important to document findings and retain evidence demonstrating that relevant security controls are being applied.