nis2-gap-analysislisted

# NIS2 Gap Analysis > Interview-driven, not knowledge-dump. Score on 5 levels. Probe for evidence, not self-assessment. **Requires**: Python 3.10+ for the applicability pre-screen script (`nis2_check.py`). The gap analysis interview itself is pure conversation — no dependencies. ## 1. Applicability pre-screen Run `python3 skills/nis2-gap-analysis/nis2_check.py --list-sectors` or with org parameters. If out of scope, stop. | Entity classification | Condition | |----------------------|-----------| | **Essential** | Annex I sector + Large (250+ / >EUR 50M) or size-exempt | | **Important** | Annex I + Medium (50-249 / EUR 10-50M) OR Annex II + Medium/Large | | **Out of scope** | Below thresholds + no exemption | Size-exempt (always in scope): TLD registries, DNS, public comms, trust services, central government. ## 2. Maturity model | Level | Name | What it looks like | Cbw | |-------|------|--------------------|-----| | **1** | Initial | Nothing. Ad hoc. Depends on one person. | Urgent gap | | **2** | Repeatable | Something on paper but inconsistent. Works if the right person is there. | Plan needed | | **3** | Defined | Documented, communicated, demonstrable. **TARGET for SME+.** | Baseline | | **4** | Managed | Periodically evaluated, KPIs measured, continuous improvement visible. | Exceeds | | **5** | Optimising | Benchmark-driven, proactive, sector-leading. | Best practice | Apply the generic rubric to each control. Only deviate where the control-specific probe note