Link risks
Show which identified risks a control is intended to address.
Requirements and controls · For IT and security managers
Requirements to track.
A clear next step.
Keep your internal requirements, controls and supporting evidence together. Start with the NIS2 requirements catalogue to see what is documented, what remains and which actions need follow-up.
A cycle of ongoing work
NIS2Follow up.
Over time.
Over time.
- Requirements
- Assessment
- Actions
- Evidence
One view of requirements
Start with the existing NIS2 requirements catalogue and keep follow-up together.
Status backed by evidence
Document how you address requirements and collect evidence for your assessment.
Gaps with a next step
Link actions to requirements so follow-up continues after the review.
01 · Requirements
Start with requirements you can work through
Requirements are easier to track when everyone uses the same catalogue. ChainSec's NIS2 requirements catalogue gives your internal security work a clear structure.
- Start with NIS2
- The built-in requirements catalogue covers ten security domains.
- Requirements and controls together
- Document how you address each requirement and the controls you use.
- A clear scope
- ChainSec brings requirements, risks and actions together. You manage governing documents and your management system separately.
02 · Assessment
Review status and document your assessment
A gap analysis should show more than what is missing. Describe what is in place and the evidence behind your assessment, giving the next review a clear starting point.
Review requirements
Assess the current position for requirements relevant to your business.
Document the work
Describe how you address each requirement and which gaps need attention.
Collect evidence
Upload files to support your documentation.
03 · Actions
Connect gaps to risks and actions
When a control needs improvement, keep the next step close to the assessment. Connect the work to relevant risks and track actions alongside the requirement.
Plan actions
Link actions to requirements and risks, with an owner and a follow-up date.
Review status
Return to the requirement after an action is completed and update your assessment.
04 · Evidence
Keep the context for your next review
When management or an auditor asks about progress, show the requirement, assessment and next step together. Keeping documentation in one place makes the review easier.
Requirements and evidence
Review status and the files supporting your assessment.
Linked risks
Explain why a control is needed and which risks it addresses.
Open actions
Show what remains and who owns the next step.
Questions about requirements and controls.
Which requirements catalogue is available today?
The NIS2 requirements catalogue is available today and covers ten security domains. It provides a shared structure for documenting the current position and following up gaps.
Is this the same as supplier questionnaires?
No. This page covers tracking your own internal requirements and controls. Supplier questionnaires collect answers and evidence from your suppliers and belong to supplier assessment work.
How do we run a NIS2 gap analysis?
Start with the NIS2 requirements catalogue, assess your current position and document what is in place. You can track gaps with actions linked to requirements. You remain responsible for determining which requirements apply and how to meet them in your business.
Can requirements and controls be linked to risks?
Yes. The risk register connects to requirements and actions. This helps you show which risks the work addresses and prioritize follow-up.
Does ChainSec replace our management system?
ChainSec brings requirements, risks, actions and evidence together. You manage your management system, document control, policies and processes separately.
Continue your work.
See how to keep requirements work together
We walk through the NIS2 requirements catalogue, documentation and gap follow-up in ChainSec's GRC offering.