Know what your evidence actually proves about your NIS2 readiness

NIS2 readiness is not just a checklist.

The useful question is whether your existing policies, procedures and operational records actually support the readiness claims you are making.

AlturaQuantera evaluates the evidence you already have, connects it to structured NIS2 readiness controls, and shows where your current position is supported, partial, or still uncertain.

See NIS2 readiness in action

Watch how AcmeFlow uses existing documents to run a NIS2 readiness assessment, review evidence-backed findings, and compare results after adding new evidence.

Product demo · 2 min

Playing this video connects to YouTube (Google).Our privacy policyGoogle privacy

Watch on YouTube (opens in a new tab)

A readiness score is only the beginning

A percentage can summarize an assessment.

It cannot explain why a control reached its current status.

For each readiness control, the more important questions are:

• what evidence was actually available;
• what that evidence proves;
• what it does not prove;
• which gaps remain;
• what should happen next.

That distinction matters because documentation and operational evidence are not interchangeable.

A continuity plan can show that recovery responsibilities are defined.

A completed restore test can show that the recovery process was actually exercised.

Both are useful evidence, but they support different claims.

×

See why a control is only partially met

In the AcmeFlow example, Business continuity planning initially reached Partially met.

AcmeFlow already had documented continuity and disaster-recovery responsibilities and evidence from an executed recovery test.

But the evidence also showed important gaps:

• object storage recovery had not been fully demonstrated;
• support-desk continuity had not been exercised end to end;
• recovery priorities, owners and RTO/RPO targets were not yet consolidated for all important services.

That is more useful than a red or amber status on its own.

It tells the team what is already defensible — and what still needs evidence.

×

Readiness should change when your evidence changes

Compliance work does not stop after the first assessment.

New procedures are approved. Tests are completed. Gaps are remediated. Evidence becomes outdated or is replaced.

Your readiness picture should change with it.

For AcmeFlow, we added new continuity evidence covering:

• service owners and recovery priorities;
• RTO and RPO targets;
• object-storage restore testing;
• a support-continuity exercise;
• retained pass/fail results and follow-up actions.

The NIS2 assessment was then run again.

The result was not a rewritten historical assessment.

It was a new assessment that could be compared with the previous run.

See exactly what changed

The reassessment showed a higher overall readiness score and several improved controls.

Most importantly for this example, Business continuity planning moved from Partially met to Met.

×

The change is traceable to evidence

A status change is only useful if you can understand why it happened.

The comparison view shows the evidence selected during the new run and how it was interpreted.

For the business continuity control, the new assessment selected evidence from the continuity exercise report and service continuity matrix, including evidence that:

• object-storage recovery was exercised;
• the support team used the documented fallback process;
• critical and important services had defined owners and recovery objectives.

×

From existing documents to evidence-backed NIS2 readiness

AlturaQuantera turns readiness work into a repeatable workflow:

Upload existing evidence → run a structured NIS2 assessment → inspect findings and supporting evidence → address gaps → add new evidence → reassess → compare what changed

The goal is not to generate a confident compliance narrative.

The goal is to make the current readiness position explainable and traceable.

What you can do with an assessment

Use the results to:

• identify controls that already have strong evidence;
• distinguish documented intent from evidence of execution;
• find partially supported or uncertain areas;
• prioritize remediation work;
• retain historical assessment results;
• compare reassessments as evidence changes.

AlturaQuantera supports readiness work and preparation. It does not replace legal advice, an audit, or a regulator’s determination.

Build a readiness picture you can explain

Your NIS2 evidence probably already exists across policies, procedures, test reports, reviews, operational records and management decisions.

The challenge is understanding what those materials actually prove.

AlturaQuantera helps turn that evidence into a readiness picture you can inspect, improve and reassess over time.