Gap assessment
The first review before any changes. It shows the state of security documentation and organisation, and the order in which to act.
Security audits and NIS2 readiness
I check where an organisation stands against KRI, ISO/IEC 27001 and the Polish National Cybersecurity System Act (KSC), and lay out a plan to reach compliance. I work from the documentation, but I also talk to people, because paperwork does not always show how things really are.
Which audit to choose
Four situations organisations usually start from.
KRI audit
A mandatory information security audit, carried out at least once a year by bodies performing public tasks in Poland.
KSC Act readiness
Determining whether the act applies, registering in the official list and putting an information security management system in place by 3 April 2027.
ISMS and GDPR documentation
Policies, procedures, risk analysis and a business continuity plan, written so that people can actually work by them.
What I check
We agree the scope at the start, but it usually covers these areas.
Documentation
- Policies, procedures and instructionscompleteness, currency and consistency, and the links between documents and registers
- Missing regulationsdocuments and formal mechanisms required by KRI, ISO/IEC 27001 or the KSC Act
Risk and continuity
- Risk analysisand how it ties in with the risk treatment plan and the safeguards in use
- Business continuitydisaster recovery plans, RPO and RTO targets, and rules for testing recovery
Day-to-day operations
- Incidents, vulnerabilities and updateshow they are detected, handled and documented
- Access and permissionsgranting, reviewing and revoking access rights
- Backups, logs and monitoringwhat is recorded, for how long and who checks it
- Remote accessrules for remote work and service access
Surroundings
- Supplierscontracts and security requirements for external companies
- Trainingfor staff and for management, who are responsible for overseeing security
How a gap assessment runs
It usually takes 3 to 6 weeks from receiving the documentation.
- Agreeing the scopecontact people, how documents are handed over and which areas need confirming
- Document analysisreviewing documents, mapping requirements, finding gaps and inconsistencies
- Interviews and workshopstalking to the people responsible for each area where documents are not enough for an assessment
- Gap analysisrating each requirement and setting its impact and priority
- Report and action plana management report, a detailed compliance matrix, a documentation map and a remediation plan
- Results presentationa closing meeting covering the main gaps and recommendations
How I rate requirements
Each requirement gets one of five ratings.
| Rating | What it means |
|---|---|
| Compliant | the requirement is regulated, described in the documentation and confirmed in practice |
| Partially compliant | the requirement is only partly regulated, or needs completing or updating |
| Non-compliant | the requirement is not met, or the existing provisions are not enough |
| Not addressed | there is no document, procedure or formal mechanism |
| Not applicable | the requirement does not apply within the agreed scope |
If materials needed for an assessment are missing, I mark the requirement as needing information until I receive them.
What you get
- Management reportmaturity level, key risks, the most important non-compliances and priorities, written for management
- Detailed gap analysisa matrix: requirement, source, document or area, rating, gap, recommendation and priority
- Documentation mapwhich documents are current and which need fixing, extending, merging, withdrawing or writing from scratch
- Remediation planwhat to do within 30 days, 1 to 3 months, 3 to 6 months and in the longer term
- Results presentationa walk-through of the gaps and recommendations with the people who will implement them
Good to know before we start
What the audit does not cover
- penetration testing and vulnerability scanning
- reviewing the configuration of Active Directory, firewalls and other devices
- writing the missing policies and procedures
Each of these can be ordered separately or as the next stage.
Confidentiality
I use documents and information from the audit only to carry it out. We agree how materials are handed over, stored and deleted before we start, and I am happy to sign a non-disclosure agreement (NDA).
Timing and pricing
A gap assessment usually takes 3 to 6 weeks. The price depends on the volume of documentation, meaning the number of documents and pages.
To start, a list of documents with page counts and the date of their last update is enough.
Other cybersecurity services
Want to know where you stand against NIS2 and KRI?
Send a list of your documents or describe your situation. I will tell you where to start and how long it will take.