Every NIS2 implementation starts the same way: you don't know what you're missingA GAP analysis will change this within 2-4 weeks. Without it, you are purchasing technology blindly and spending where it is not needed.
What is a NIS2 GAP analysis
A GAP analysis (gap analysis) is a systematic comparison of the current security status in your organisation with the requirements set out by Act No. 264/2025 Coll. On Cybersecurity and Implementing Decree No. 409/2025 Coll.
The result is a specific list of what is missing or fails to meet requirements - ranked by priority and risk. Not general recommendations, but your specific action plan.
Why start with a GAP analysis rather than proceeding straight to implementation
Three most common mistakes by companies without a GAP analysis:
- Purchase of a firewall that is already in place - or a version that offers no security improvement over the existing one.
- Creates documents that the law does not require. - and yet lacks those that are required.
- Overlook a critical gap - typically in access rights, advance payments or incident reporting - which will cause problems during the NÚKIB inspection.
A GAP analysis costs 40 000-120 000 Kč. Implementing without it may cost you double in unnecessary expenses.
What a GAP analysis examines
In accordance with the requirements of Act No. 264/2025 Coll. And Decree No. 409/2025 Coll., the GAP analysis focuses on these 10 areas:
Do you have a formalised process for identifying and assessing risks?
Are there written security policies approved by management?
Do you apply the principle of least privilege and MFA?
Do backups work? Do you have a tested recovery plan?
Do you have a defined procedure for detection, escalation and reporting?
Firewall, EDR, patch management, encryption: status and coverage.
Do you have security requirements for key suppliers?
Are regular safety training sessions and phishing tests being carried out?
Do you encrypt data in transit and at rest? Which algorithms?
Do you collect logs? Do you have a SIEM or anomaly alerting in place?
How a GAP analysis is carried out in practice
The entire process usually takes 2-4 weeks and consists of four steps:
- Initial questionnaire and inventory - We gather information about your IT environment, systems, employees, suppliers and currently implemented security measures. This is carried out remotely or in the form of a workshop.
- Technical inspection - review of existing documentation, configuration of key systems, setting up access rights, and status of backups. We will also carry out a preliminary vulnerability scan.
- Conformity assessment - we compare each area against the requirements of the Act and the Decree. The result is an assessment: met / partially met / not met.
- Final Report and Action Plan - you will receive a written report with a prioritised list of measures, cost estimates and a time schedule. The report is suitable for presentation to management and as a basis for implementation planning.
What You Will Find in the Final Report
The output of a GAP analysis is not just a list of problems. It includes:
- Overall compliance rating in % (typically 30-70% for companies without ISO 27001)
- Risk matrix: which gap represents the highest risk during NIS2 compliance checks
- Prioritised action plan (quick wins vs. Long-term measures)
- Cost estimate for implementation with a breakdown of items
- Recommendations for selecting technologies (firewall, EDR, backups)
- Templates of key documents as a basis for policy creation
Can I carry out a GAP analysis myself?
Partly yes: online audit at NIS2OK.cz will give you an overview in 10 minutes. It is an excellent first step and you will find out approximately what condition you are in.
A full GAP analysis for legal purposes and management presentation requires in-depth technical verification and knowledge of the current interpretative practice of NÚKIB. Without experience from other implementations, you cannot calibrate this correctly.
Beware of "NIS2 GAP templates" from the internet
Act No. 264/2025 Coll. Has been in force since October 2025, and Implementing Decree No. 409/2025 Coll. Introduced specific requirements for the Czech Republic. Foreign templates are based on EU Directive 2022/2555 itself and may not cover Czech specifics, particularly notification obligations towards NÚKIB.
When to start with a GAP analysis
The implementation deadline for technical measures is 17 October 2026A realistic GAP analysis plus implementation takes 4-6 months. If you start after July 2026, you will only meet the deadline with difficulty. Overview of all NIS2 deadlines for 2026.
Start with a free consultation
We will review your current situation and explain what a GAP analysis entails for your company and to what extent it applies.
Non-binding consultation →