Free tool
Free NIS2 self-assessment
A quick check in 25 questions, before the official self-assessment under DNSC Order 1/2026. You get a score per area, concrete actions and a summary for management. This is not an audit under GEO 155/2024 and does not replace one.
Start the check
Enter your details to use the calculator. We email you the full result.
What is the NIS2 self-assessment?
The maturity self-assessment is the yearly duty in Art. 12(4): the entity assesses its security measures and management signs off the result. The first one is due 60 days after the risk-level assessment (Art. 18(7)). The tool on this page is only preparation, not the official form DNSC asks for.
How does the official self-assessment work?
It is done with the EVAL_MMS_B, EVAL_MMS_I and EVAL_MMS_E tools until DNSC's NIS2@RO platform is operational. Each control gets a score from 1 to 5 for documentation and for implementation. Key measures need at least 2.5 at Basic level and 3 at Important and Essential level, under the Methodology.
The total score must be at least 2.5 at Basic level, 3 at Important and 3.5 at Essential, where each category must reach 3. Below target, the entity draws up a remediation plan (Art. 3 of the Methodology).
How is the score here calculated?
Each answer earns points: Yes 2, Partly 1, No and Don't know 0. An area's score is the percentage of its maximum: red under 50%, amber from 50% to 79%, green from 80%. Backup and continuity questions count double in the overall score, because backup is a key measure at every level.
Which questions does the check contain?
There are 25 questions in 12 areas: registration, the ten minimum measures of Art. 13 and the management duties of Art. 14. Each question shows its legal basis and, where one exists, the control code from the Measures approved by DNSC Order 1/2026, so you know what the official assessment will ask.
| Area | Question | Basis | Control |
|---|---|---|---|
| Registration and self-assessment | 1. Has the company notified DNSC and been registered? | Art. 18 | – |
| Registration and self-assessment | 2. Has management signed off this year's self-assessment of security measures? | Art. 12(4) | – |
| Risk and policies | 3. Is there a written risk analysis, reviewed in the last 12 months? | Art. 13(a) | ID.RA-05.1 |
| Risk and policies | 4. Is there an information security policy approved by management? | Art. 13(a) | GV.PO-01.1 |
| Effectiveness of measures | 5. Are security measures tested or reviewed on a schedule (internal check, penetration test, audit)? | Art. 13(b) | ID.IM-02.1 |
| Encryption | 6. Are laptops, backups and data in transit encrypted? | Art. 13(c) | PR.DS-01.6, PR.DS-02.2 |
| Supply chain | 7. Do you have a list of critical IT suppliers, with security terms in their contracts? | Art. 13(d), 11(8) | GV.SC-05.2, GV.SC-07.2 |
| Systems life cycle | 8. Are systems patched on a defined schedule? | Art. 13(e) | ID.AM-08.2 |
| Systems life cycle | 9. Are old disks and devices wiped or destroyed with proof? | Art. 13(e) | PR.DS-01.9, ID.AM-08.5 |
| People, access and assets | 10. Is there an up-to-date list of IT assets? | Art. 13(f), 11(7) | ID.AM-01.1 |
| People, access and assets | 11. Are access rights reviewed and removed promptly when people leave? | Art. 13(f) | PR.AA-05.1, PR.AA-01.1 |
| Incidents | 12. Is there an incident response plan that covers the DNSC reporting deadlines (24 hours early warning, 72 hours notification)? | Art. 13(g), 15 | RS.MA-01.1, RS.CO-02.2 |
| Incidents | 13. Are system logs turned on, kept for a set period and reviewed regularly? | Art. 13(g) | PR.PS-04.1, DE.AE-03.1 |
| Continuity and backup | 14. Are backups stored on a system separate from the production systems? | Art. 13(h), PR.DS-11.1 | PR.DS-11.1 |
| Continuity and backup | 15. Is at least one backup copy kept fully offline or physically isolated? | Art. 13(h), PR.DS-11.1 | PR.DS-11.1 |
| Continuity and backup | 16. Was a full restore tested in the last 12 months, with a written record? | Art. 13(h), PR.DS-11.2 | PR.DS-11.2 |
| Continuity and backup | 17. Could an attacker with administrator rights delete or encrypt every backup copy? | Art. 13(h), PR.DS-11.1 | PR.DS-11.1, PR.AA-05.4 |
| Continuity and backup | 18. Is there a written business continuity and disaster recovery plan with recovery time targets? | Art. 13(h) | RC.RP-01.1, GV.OC-04.4, ID.IM-04.1 |
| Hygiene and training | 19. Have staff had cybersecurity training in the last 12 months? | Art. 13(i), 14(2) | PR.AT-01.1 |
| Hygiene and training | 20. Are firewalls configured and maintained, with critical systems separated by network segmentation? | Art. 13(i) | PR.IR-01.1, PR.IR-01.2 |
| Hygiene and training | 21. Is anti-malware protection installed and kept up to date on all systems? | Art. 13(i) | DE.CM-01.2 |
| MFA and secure communications | 22. Is multi-factor authentication on for email, remote access and admin accounts? | Art. 13(j) | PR.AA-03.2 |
| Management | 23. Has management approved the security measures, and does it oversee them? | Art. 14(1) | GV.RR-01.1 |
| Management | 24. Was a network and information systems security officer named within 30 days of the DNSC decision? | Art. 14(3)–(4) | GV.RR-02.1, GV.RR-02.2 |
| Management | 25. Has management completed accredited cybersecurity training? | Art. 14(2) | PR.AT-02.1 |
Frequently asked questions
Does this check replace the official self-assessment?
No. It is a quick pre-check. The official self-assessment is done with the DNSC tools and signed off by management. This is not an audit under GEO 155/2024 and does not replace one.
Are my answers stored?
Not the individual answers. The server receives only the area scores and the four backup answers, so the result can be shown through a signed link that stays valid for 30 days.
How long does it take?
About ten minutes. There are 12 screens, and if you do not know an answer, choose Don't know: it counts as No, because a measure you cannot prove does not help you with DNSC.
When must the self-assessment go to DNSC?
The first one 60 days after the risk-level assessment, then yearly (Art. 18(7), 12(4)). Essential entities file a remediation plan within 30 days of each self-assessment (Art. 12(5)).
What is CyFun?
CyberFundamentals (CyFun) is the security framework developed by the Centre for Cybersecurity Belgium. DNSC's EVAL_MMS files are the self-assessment tools for version 2025 of this framework.
Can I send the result to management?
Yes. The result page has a button that opens an email with a signed link, and the summary for management shows the entity class, the maximum fine, the Art. 14 duties and the three weakest areas.
Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.