Free tool

How ready are you for the audit?

Choose a framework and answer 9 questions. The tool shows each gap with its law or standard reference and tells you what to do.

EU NIS2 Directive (EU) 2022/2555. Essential and important entities operating in the EU, and the suppliers that serve them. Official text (EUR-Lex)
  1. 1. Article 21(2)(a)Do you have a written risk analysis and information security policy?
  2. 2. Article 21(2)(b)Do you have a defined process to detect, investigate and close security incidents?
  3. 3. Article 21(2)(c)Do you have ransomware-protected backups and a tested recovery plan?
  4. 4. Article 21(2)(d)Do you assess the security risk of the SaaS tools and suppliers you use?
  5. 5. Article 21(2)(e)Do you scan for vulnerabilities regularly and install critical patches within a set time?
  6. 6. Article 21(2)(g)Do you give regular cybersecurity training to staff and management?
  7. 7. Article 21(2)(i)Do you have a current inventory of every device and role-based access control?
  8. 8. Article 21(2)(j)Is multi-factor authentication (MFA) required for remote access and admin accounts?
  9. 9. Article 23 · 24 hours / 72 hoursFor a significant incident, can you send an early warning within 24 hours and a notification within 72 hours?
Important: This test is a first assessment. It does not replace legal advice or an audit. The questions are based on the articles in the official texts and were last reviewed in November 2026. For a final answer, work with an independent auditor or legal adviser.
ENTERPRISE SECURITY & BUSINESS RESILIENCE

Close the gaps with one agent

Moftgate combines DLP, DSPM and endpoint management. With on-premises deployment your data stays on your servers, and audit evidence is produced automatically.