NIS2 Gap Assessment

An open data format. The questions a NIS2-regulated entity needs to ask itself to find compliance gaps, expressed once as a typed Zod schema with reference scoring logic, and published as JSON + JSON Schema.

It exists because every Mittelstand and every consultancy in Germany is currently writing their own NIS2 self-assessment from scratch, slightly differently each time, anchored to slightly different paragraphs. This repo is one shared, openly maintained, legally-anchored set of questions that any of them can adopt or fork.

What it isn't

Not an app, not a SaaS, not a UI. There is no backend, no auth, no database. Bring your own.

The reference implementation is at nisd2.eu/nis2-gap-assessment-schema, which uses this exact data format. You are free to build your own.

What's in it

• 116 questions across 15 domains, structured for a 5-day completion cadence
• Each question anchored to a primary source — NIS2 Directive (EU) 2022/2555, BSIG (Germany), CIR 2024/2690 (EU), or BSI IT-Grundschutz
• Every question carries severity (CRITICALITY), suggested respondent (RESPONDENT), worst-case consequence (CONSEQUENCE), and time-to-fix estimate (TIME_TO_FIX)
• A dependsOn graph so prerequisite questions surface first
• Two locales: English and German, in both regulator-style and plain-language phrasing
• Reference scoring logic with maturity levels (critical → initial → developing → managed → optimized)
• Published as a Zod schema (TypeScript), a JSON artefact, and a JSON Schema for non-TS consumers

How it's maintained

• Source of truth: TypeScript files in src/domains.ts and src/questions/day-<n>.ts. Edit these, never edit the JSON.
• Generated artefacts: data/gap-assessment.json and schema/gap-assessment.schema.json — regenerated by bun run build:json.
• Invariant tests: tests/invariants.test.ts — uniqueness, cross-references, day-domain consistency, dependsOn cycle detection, scoring sanity, helper behaviour.
• CI: typecheck, validate, tests, drift check on every push.

Install

This package is not on the npm registry — install directly from GitHub.

bun add github:NISD2/nis2-gap-assessment-schema#v2.0.2
# npm, pnpm, yarn — same syntax

If you only need the data or the JSON Schema, download them directly from the repo. No build step.

Usage

import {
  gapAssessment,
  computeScores,
  ANSWER,
} from "@nisd2/nis2-gap-assessment-schema";

const answers = {
  "gap-0-01": ANSWER.YES,
  "gap-0-02": ANSWER.PARTIALLY,
};

const scores = computeScores(gapAssessment.questions, answers);
console.log(`Overall: ${scores.overall}%, top gaps:`, scores.gaps.slice(0, 5));

More examples — Drizzle storage — under examples/.

Question shape

{
  id:           "gap-0-01"                   // stable kebab-case key
  domain:       0                            // references domains[].id
  text:         { en, de }                   // regulator-style phrasing
  plainText:    { en, de }                   // CEO-readable phrasing
  legalBasis:   "§28 BSIG"                   // canonical primary citation
  criticality:  CRITICALITY.CRITICAL         // LOW | MEDIUM | HIGH | CRITICAL
  respondent:   RESPONDENT.CEO               // CEO | IT | HR | PROCUREMENT | ANYONE
  consequence:  CONSEQUENCE.FINE             // AUDIT_FINDING | OPERATIONAL_RISK | FINE | PERSONAL_LIABILITY
  fineExposure: true                         // does failing this draw a regulatory fine
  timeToFix:    TIME_TO_FIX.QUICK_WIN        // QUICK_WIN | DAYS | WEEKS | MONTHS
  day:          1                            // 1..5, must match the parent domain's day
  dependsOn:    []                           // question IDs that should be answered first
}

Full Zod schema in src/schema.ts.

Not legal advice

Structured guidance based on our reading of NIS2, BSIG, CIR 2024/2690, and BSI IT-Grundschutz. It does not constitute legal advice. Consult qualified counsel.

Companion repo

NISD2/nis2-supply-chain-questionnaire-schema — same data-format approach for the NIS2 supply-chain due diligence questionnaire.

Contributing · Security · Changelog

CONTRIBUTING.md · SECURITY.md · CHANGELOG.md

Licence

Dual: MIT for code, CC BY 4.0 for content. See LICENSE.

Substantive issues / partnership questions: contact@nisd2.eu.