NIS2 Gap Analysis: In-House or Hire a Consultant? Process, Duration, Cost

Written by the NIS2Compass editorial team / As of: November 2026

A NIS2 gap analysis checks your current state against the ten minimum measures in § 30 (2) BSIG, the incident reporting process (§ 32) and the management body's duties (§ 38). A first in-house comparison is possible with the NIS2Compass template "NIS2 Gap Assessment". An external analysis costs around EUR 6,500 to 13,000 (5 to 10 consulting days × EUR 1,300 BDU average, with the days as a planning assumption).

What Does a NIS2 Gap Analysis Check, and Is It Mandatory?

A NIS2 gap analysis compares what your company does today with what § 30 (2) BSIG requires as minimum measures. "Gap analysis" is not a legal term, but the BSI recommends it in its #nis2know roadmap as the step "analyse the state of cybersecurity (gap analysis)" (translated). The result is a prioritised gap list whose implementation management must oversee under § 38 (1) BSIG.

The benchmark is § 30 BSIG as amended by the NIS2UmsuCG, which transposes the NIS2 Directive and has applied since 6 December 2025 without a general transition period. It applies, among others, to the 20,141 entities registered by 30 September 2026 per the BSI statistics "NIS-2 in Zahlen" (6,837 particularly important, 13,252 important). The analysis covers its ten points:

1. Policies on risk analysis and information security
2. Incident handling
3. Business continuity, backup management and crisis management
4. Supply chain security
5. Acquisition, development and maintenance, including vulnerability management
6. Assessing effectiveness
7. Training and awareness
8. Cryptography and encryption
9. Human resources security, access control and asset management
10. Multi-factor authentication and secured communications

The NIS2Compass template "NIS2 Gap Assessment" follows these ten points. Added to this are the reporting process under § 32 BSIG (deadlines of 24 hours, 72 hours and one month) and the training obligation for management under § 38 (3) BSIG.

According to its Art. 1, Implementing Regulation (EU) 2024/2690 only covers certain digital services such as cloud, data centre and DNS providers, managed service providers and online marketplaces. For them, its requirements take precedence under § 30 (3) BSIG; for everyone else, the annex is guidance only.

Three groups benefit: IT management (a work plan), the ISO (the basis for documentation under § 30 (1)) and management, which is personally liable under § 38 (management liability under § 38 BSIG).

What Happens If You Skip the Gap Analysis?

Failing to take or document measures is an administrative offence under § 65 (2) nos. 2 and 3 BSIG. The fine calculator shows your fine range.

Without an inventory, you can neither prove which measures are in place nor give management the basis to "implement them and oversee their implementation" (translated) under § 38 (1).

Internal Self-Assessment or External Gap Analysis: What Is the Difference?

An internal self-assessment captures the current state quickly and cheaply, but suffers from blind spots: IT often rates its own work. An external gap analysis brings independence and NIS2 expertise, but costs consulting days. For many SMEs a hybrid approach makes sense: prepare in-house, have it validated externally.

In-house strengths:

• Your IT knows assets, services and suppliers better than any consultant.
• You gather existing policies and logs fastest yourself.
• You can do the first traffic-light comparison against the ten points of § 30 (2) BSIG yourself.

In-house weaknesses:

• Blind spots and independence: IT operations audits itself, a classic conflict of interest.
• Interpretation: In its ISO/IEC 27001 info package, the BSI writes: "A structured gap analysis must examine:" (translated). This refers to ISO-certified companies. In essence, it then lists whether all legally required measures are implemented and whether risks were accepted or transferred even though § 30 requires implementation. An ISO certificate does not replace this comparison (Is ISO 27001 enough for NIS2?).

Independent does not necessarily mean external. In Annex point 2.3, Implementing Regulation (EU) 2024/2690 requires independent reviews for the digital entities named in Art. 1 (§ 30 (3) BSIG), such as cloud and managed service providers. In essence, in-house reviewers must not sit in the reporting line of the area reviewed. For all other entities this is guidance, not an obligation: an ISO outside the IT reporting line can cross-check internally.

External makes sense if:

• You are preparing for a request for evidence under § 61 or § 62 BSIG (NIS2 evidence and audits).
• Your IT is spread across several sites.
• Your group or your customers require an independent assessment.
• Management wants an independent basis for its duties under § 38 BSIG.

The hybrid approach saves consulting days. You prepare inventory, documents and self-assessment in-house; the consultant validates and writes the report. For a full-project comparison, see NIS2 consultant or DIY?.

For the in-house part, the NIS2Compass Template Library offers the Excel template "NIS2 Gap Assessment", which checks the ten points of § 30 (2) BSIG, and the "Gap Report for Management" (Word, § 38 BSIG). A starting point is the Pre-Check on the NIS2Compass platform: 20 yes/no questions that pre-mark the relevant steps in the NIS2 Guide. It does not replace a full gap analysis.

How Does a NIS2 Gap Analysis Work, and How Long Does It Take?

A NIS2 gap analysis runs in nine steps: define the scope, appoint owners, collect documents, conduct interviews, compare against § 30 (2), § 32 and § 38 BSIG, rate, prioritise, report to management and repeat. There is no official duration. The NIS2Compass planning figure for an SME is four to eight calendar weeks.

1. Clarify scope and applicability: Check entity type, sites, services and BSI registration, for example with the NIS2 applicability check. For digital entities under Art. 1 of Implementing Regulation (EU) 2024/2690, such as cloud providers, its requirements take precedence (§ 30 (3) BSIG).
2. Appoint owners: Management issues the mandate, the ISO or IT management leads, and each department names a contact.
3. Collect documents: Policies, asset and supplier inventories, contingency and backup plans, supplier contracts and training records.
4. Conduct interviews: with IT operations, procurement (supply chain), HR and management.
5. Compare: against the ten points of § 30 (2) BSIG, the reporting process under § 32 and management duties under § 38. A NIS2 checklist as an Excel template keeps it complete.
6. Rate: each requirement as "implemented", "partially" or "not implemented", or alternatively as a maturity level.
7. Prioritise: The BSI's #nis2know roadmap has a dedicated step for this: "sort measures by priority (quick wins vs. critical weaknesses)" (translated).
8. Report and action plan: It names owners, deadlines and resources. This lets management fulfil its duty under § 38 (1) BSIG to "implement the measures and oversee their implementation" (translated).
9. Repeat: § 30 (2) no. 6 requires policies for assessing effectiveness, so the gap analysis is not a one-off exercise. Recommended: annually and after significant changes.

Duration has two dimensions. Person-days measure the effort: externally, 5 to 10 consulting days.

Calendar weeks measure lead time, driven by interview dates and the state of documentation. For an SME with 50 to 250 employees: four to eight calendar weeks. Both values are NIS2Compass planning assumptions, not official figures.

The explanatory memorandum to the law (BT-Drs. 21/1501) only quantifies overall implementation: for the minimum level under §§ 30, 31 and 38 (1) BSIG, it assumes around 1,100 hours per year for each important entity and 2,752 hours for each particularly important entity. For the one-off effort, it states that "there are no indications on which to base an estimate" (translated). The gap analysis is only a small part of this effort.

What Does a NIS2 Gap Analysis Cost, and Is EUR 8,000 a Fair Price?

An external NIS2 gap analysis costs around EUR 6,500 to 13,000 (5 to 10 consulting days × EUR 1,300 BDU average), with the days as a planning assumption. A quote of EUR 8,000 equals roughly six consulting days and is therefore within the range. Whether it is fair depends on scope and deliverables, not just price.

Where Does the Range Come From?

The BDU fee study 2025 reports an average daily rate of EUR 1,300 across all consulting fields. By seniority, the average ranges from EUR 700 (analyst) to EUR 1,600 (partner). Planning with 5 to 10 consulting days gives around EUR 6,500 to 13,000 (5 to 10 consulting days × EUR 1,300 BDU average).

The number of days is a planning assumption. There is no official effort figure for gap analyses. The effort depends mainly on:

• the number of sites and interviews
• the state of existing documentation
• the benchmark: § 30 BSIG only, or also Implementing Regulation (EU) 2024/2690, which takes precedence for the digital entities named in its Art. 1 (§ 30 (3) BSIG)
• the depth of the final report and action plan

For daily rates by seniority, see What does external NIS2 consulting cost?.

How Can You Tell Whether a EUR 8,000 Quote Is Fair?

Roughly six consulting days are only fairly priced if the quote includes:

• Scope: all ten points of § 30 (2) BSIG, plus the reporting process (§ 32) and management duties (§ 38)
• Deliverable: a prioritised action plan with owners and deadlines
• Services: interviews, document review and a final presentation to management
• Transparency: daily rate, days and seniority itemised, because six partner days deliver something different from six analyst days

Technical vulnerability assessments such as pen tests or scans are usually excluded.

What Does an In-House Gap Analysis Cost?

In-house, you pay with working time. An example: 8 person-days × 8 hours × EUR 56.08 comes to around EUR 3,590. The hourly wage comes from the explanatory memorandum to the NIS2UmsuCG (BT-Drs. 21/1501); the 8 days are an assumption. In-house preparation reduces external consulting days.

Against the overall budget, the gap analysis is a small item, as the overview of NIS2 compliance costs shows.

Where Can You Find NIS2-Compliant Gap Analyses and Vulnerability Assessments?

A gap analysis checks the organisation against the requirements; a vulnerability assessment checks the technology with scans or penetration tests. There is no official "NIS2-compliant" seal for either. The BSI does, however, publish lists of certified providers for IS audits and IS penetration tests, which let you check a provider's qualifications.

The gap analysis checks the organisation. It compares processes, policies and evidence with the requirements of § 30 BSIG. The BSI describes the related IT-Grundschutz check as a "target/actual comparison" (translated).

The vulnerability assessment checks the technology. Scans and pen tests show where systems are vulnerable. Legally, they tie in with § 30 (2) nos. 5 and 6 BSIG: vulnerability management and assessing effectiveness. In its gap analysis step, the BSI roadmap explicitly lists "carry out vulnerability analyses, pen tests, external audits" (translated).

The BSI's practical guide to IS penetration tests dates from 2016. It states their purpose: "IS penetration tests serve to find further attack vectors with an independent view […]" (translated).

These BSI pages help you find providers (in November 2026, the two lists had 21 and 22 entries respectively):

• The IS audit list contains BSI-certified IT security service providers for information security audits.
• The IS penetration test list names certified service providers for technical security tests.
• The qualified service providers overview bundles the guides on IS audits and penetration testing plus the list for APT response in an emergency.

The lists prove a provider's qualifications, not your NIS2 compliance.

How Does a 120-Employee Machine Builder Assess a EUR 8,000 Quote?

A 120-employee machine builder, an important entity under § 28 (2) BSIG, receives a quote of EUR 8,000 for a NIS2 gap analysis. It first checks the scope against § 30 (2), § 32 and § 38 BSIG. It then prepares inventory and self-assessment in-house and negotiates the quote down to a validation.

The scenario is fictitious and anonymised. The special-purpose machinery manufacturer operates from one site, and its IT department has four people. The trigger is a major customer asking about its NIS2 status.

The company is not starting from zero: in the explanatory memorandum to the NIS2UmsuCG (BT-Drs. 21/1501, p. 111), the federal government assumes that around 17 percent of affected companies already take sufficient measures. For the rest, only the inventory shows what is missing.

At the BDU average, the quote equals roughly six consulting days. The scope covers § 30, but the statement of work lacks the reporting process under § 32 and management training under § 38 (3) BSIG. A final presentation to management is not included either.

IT management requests these missing items in writing.

The company then chooses a hybrid approach. IT management pre-fills the ten points in-house: inventory, existing documents, a first traffic-light rating. The ISO, outside the IT reporting line, cross-checks. The consultant then validates and writes the report.

Assuming three to four consulting days at EUR 1,300, the external part costs around EUR 3,900 to 5,200 instead of EUR 8,000, plus the internal hours. All days are scenario assumptions.

Before signing a quote, lay it next to the ten points of § 30 (2) BSIG and cross out what is missing. The Excel template "NIS2 Gap Assessment" and the "Gap Report for Management" from the NIS2Compass Template Library provide the framework.

Frequently Asked Questions

A consultant quoted EUR 8,000 for a NIS2 gap analysis. Is that a fair price?

On price, yes: EUR 8,000 equals roughly six consulting days. With 5 to 10 consulting days as a planning assumption, an external analysis costs around EUR 6,500 to 13,000 (5 to 10 consulting days × EUR 1,300 BDU average). The quote is fair if it covers all ten points of § 30 (2) as well as § 32 and § 38 BSIG and delivers a prioritised action plan.

What happens if you don't do a NIS2 gap analysis?

Legally, nothing directly: "gap analysis" is not a BSIG term. What is mandatory are the measures under § 30 BSIG and their documentation. If they are missing, fines apply under § 65 BSIG: up to EUR 10 million for particularly important and EUR 7 million for important entities. Without an inventory, you will struggle to prove either.

Where can I find providers for gap analyses and penetration tests?

The BSI publishes lists of certified IT security service providers for IS audits and IS penetration tests. They prove a provider's qualifications; there is no official "NIS2-compliant" seal. A gap analysis and a penetration test are different services: one checks the organisation, the other the technology. Commission them separately, or explicitly require both in the quote.

How do I prepare a gap analysis ahead of a NIS2 audit?

For each of the ten points of § 30 (2) BSIG, collect inventory, policies and existing evidence. Appoint owners and schedule interviews early. Filing evidence during the comparison gives you the documentation required under § 30 (1). There is no NIS2 certificate; an audit is a possible review under §§ 61 and 62 BSIG.

Is there an Excel template for a NIS2 gap analysis?

Yes. The NIS2Compass Template Library includes the Excel template "NIS2 Gap Assessment", which checks the ten points of § 30 (2) BSIG. Alongside it comes the "Gap Report for Management", a Word template for reporting under § 38 BSIG. Both templates are part of the Pro plan (EUR 29 per month) and are not free.