Skip to content

Skills tagged NIS 2

14 skills relate to NIS 2. The tag says which framework a skill relates to; the skills contain no text from it.

Business impact analysisUse this skill when a company needs recovery objectives it can defend, before a continuity plan, a disaster recovery design, an audit or a resilience review, and asks "do a BIA", "business impact…Incidents and continuityISO 27001, DORA, NIS 2, GeneralTristan Roth
Continuity tabletop designUse this skill when a company must test its incident response or continuity plan without breaking anything, because an audit, a customer, a regulator or the plan itself calls for an exercise, and…Incidents and continuityISO 27001, SOC 2, DORA, NIS 2Tristan Roth
Evidence request list builderUse this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence…EvidenceISO 27001, SOC 2, NIS 2, DORATristan Roth
First gap assessmentUse this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the…Gap and readinessGeneral, ISO 27001, SOC 2, HIPAA, NIS 2, ISO 42001Tristan Roth
GRC setup reviewUse this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit…Gap and readinessGeneral, ISO 27001, SOC 2, GDPR, NIS 2, DORA, ISO 42001, EU AI ActTristan Roth
Incident response plan draftingUse this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write…Incidents and continuityISO 27001, SOC 2, HIPAA, NIS 2Tristan Roth
Incident severity triageUse this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is…Incidents and continuityGeneral, ISO 27001, SOC 2, NIS 2, DORATristan Roth
Internal audit checklist from scopeUse this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit…Audit prep and responseISO 27001, ISO 42001, GDPR, NIS 2, DORATristan Roth
Logging and monitoring evidence packUse this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and…EvidenceISO 27001, SOC 2, NIS 2Tristan Roth
Multi-framework overlap mapUse this skill when a company answers to two or more frameworks and is collecting the same evidence twice, and asks "map our controls across frameworks", "crosswalk between our certification and our…Gap and readinessGeneral, ISO 27001, SOC 2, NIS 2, NIST CSF, GDPRTristan Roth
NIS 2 entity applicability checkUse this skill when a company needs to know whether the NIS 2 Directive applies to it, and asks "are we in scope of NIS 2", "are we an essential or important entity", "which country supervises us"…Gap and readinessNIS 2Tristan Roth
Regulatory incident reporting clockUse this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a…Incidents and continuityNIS 2, DORA, GDPR, HIPAATristan Roth
Risk register first passUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what…RiskISO 27001, SOC 2, NIS 2, DORA, GeneralTristan Roth
Vendor tieringUse this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all"…Vendors and third partiesGeneral, ISO 27001, SOC 2, DORA, NIS 2Tristan Roth