NIS 2 gap assessment template: how to score 56 controls in Excel

Published 20 October 2026 · 6 min read

A NIS 2 gap assessment template in Excel is a list of control points derived from Article 21 of Directive (EU) 2022/2555, one row each, with a status chosen from a short list, a score calculated from the status, a weight for criticality, a weighted gap and a priority. Formulas then give a compliance rate per domain and a ranked list of gaps that becomes the action plan. The workbook described here uses 56 control points in 10 domains; the mechanics work the same with your own list. The directive itself prescribes no scoring method: Article 21(1) asks for appropriate and proportionate measures, Article 21(4) for corrective measures without undue delay when you find you do not comply. The assessment is how you find out, and how you show it.

What a gap assessment is for

Three uses, in this order: to know where the entity stands against the ten measures of Article 21(2); to decide, with the management body, which gaps to close first, since Article 20(1) requires it to approve the measures and oversee their implementation; and to keep dated evidence. Articles 32(2) and 33(2) let competent authorities request evidence of implementation of cybersecurity policies. A dated assessment, the plan that followed and the next assessment showing progress are exactly that kind of evidence.

Choosing the control list

The ten lines of Article 21(2) are too coarse to score: "incident handling" is either all compliant or not, which says little. Sources for a finer list, all public or standard:

• the directive's own articles beyond Article 21: governance (Article 20), registration data (Article 3(4)), reporting (Article 23);
• for DNS, cloud, data centre, managed service and other digital providers, Implementing Regulation (EU) 2024/2690 of 17 October 2024, which is binding for them, and ENISA's NIS2 Technical Implementation Guidance of 26 June 2025, which explains it with examples of evidence;
• ISO/IEC 27001:2022 and its Annex A, if you run or plan a management system;
• the framework of your national authority, once national law applies.

Whatever the source, keep a "Directive reference" column on every row, so that each point traces back to an article. The 56-point list in the workbook below is built that way:

Each point also carries a criticality (32 points are rated High, 21 Medium and 3 Low in this list), the evidence expected and the action recommended if a gap is found.

The scoring scale and its traps

Four statuses are enough: Compliant, Partial, Non-compliant, Not applicable, plus a blank for "to assess". A three-level score keeps the debate short: Compliant = 1, Partial = 0.5, Non-compliant = 0. The traps are predictable:

• Partial as a comfort zone. Define it per point: "Partial" means the measure exists but not on the whole scope, or exists without proof.
• Scoring intentions. A point is compliant when the evidence column can be filled with a document, a log or a test report, not a plan.
• "Not applicable" as an escape. Require a written reason, and approve it with the rest.
• Averages that hide a red domain. Read the domain rates, not only the overall figure.
• Blank cells. Treat a point not yet assessed as non-compliant in the rate, as the workbook does, so that the rate cannot rise by assessing less.

Score per domain with Excel formulas

With the status in column F and the criticality in column E, one row per point, five formulas do the work (written here with plain values; in the workbook they point to named parameters on a Lists sheet):

1. Score (L): =IF(F8="Compliant",1,IF(F8="Partial",0.5,IF(F8="Not applicable","",0)))
2. Weight (M): =IF(E8="High",3,IF(E8="Medium",2,1))
3. Weighted gap (N): =IF(F8="Not applicable",0,M8*(1-L8))
4. Priority (O): =IF(N8>=2,"P1",IF(N8>=1,"P2",IF(N8>0,"P3","")))
5. Domain rate: =IF(C10=0,0,SUMIF(Domain,A10,Score)/C10), where C10 counts the domain's points not marked "Not applicable" with COUNTIFS(Domain,A10,Status,"<>Not applicable").

With these thresholds, a High or Medium point that is non-compliant is P1, a High point that is partial or a Low point that is non-compliant is P2, and a Low point that is partial is P3. A RAG status per domain follows: green from 80%, amber from 50%, red below. All thresholds are conventions of the template, not of the directive: change them on the Lists sheet if your board prefers others, and say so in the report.

Reading the gaps and picking five priorities

A fictitious continuity domain shows how the numbers read:

The domain rate is (0.5 + 0 + 0 + 1 + 0) / 5 = 30%: red. Across all domains, sort by weighted gap, then by the nearest due date, and keep the first five for the next 90 days. Five is a working limit, not a rule: it is the number of actions a small team can drive and the board can follow.

From assessment to 90-day plan

Each priority gets an owner, a due date, the evidence that will close it and a cost. The plan goes to the management body for approval, and the next assessment, dated, shows what moved. For costing, the logic of an IT budget with committed and forecast amounts applies; see IT budget template in Excel. For what each measure covers, see NIS 2 Article 21: the measures one by one, and for the other obligations, the NIS 2 compliance checklist.

FAQ

Is there an official NIS 2 gap assessment template?

The directive contains none. Digital providers covered by Implementing Regulation (EU) 2024/2690 can build their list from it and from ENISA's guidance of 26 June 2025; other entities use Article 21 and, once available, their national framework.

How often should the assessment be repeated?

The directive sets no frequency. A full assessment once a year, with the priority gaps reviewed each quarter, is one workable rhythm; reassess a domain after a significant incident or a major change.

Can the assessment be done without an external auditor?

Yes. A self-assessment is a starting point and internal evidence. Authorities may request the results of security audits carried out by a qualified auditor (Articles 32(2) and 33(2)), so keep the evidence column complete in case one is needed.