Depth 28.1.1 · NIS2 and DORA readiness · Level 4
Control gap register
A control gap register lists every requirement that applies to you under a framework such as NIS2, Directive (EU) 2022/2555, or DORA, Regulation (EU) 2022/2554, and records against each one the control that meets it, the evidence that shows it, the owner, or the gap where nothing does. Which framework applies is a question for your counsel.
Specification
- Input
- Your counsel's view on which framework applies, current policies, and the system and supplier inventories.
- Method
- We break the framework text into single requirements, map each to systems and teams, record the control and its evidence, and mark it met, partial or gap with a planned date for each gap.
- Deliverable
- The register as an editable sheet your auditors and counsel can read, with owners and dates.
- Measured by
- Requirements marked met with current evidence, and gaps closed by their planned dates.
What the file contains
- Requirement breakdown
- Control and evidence per requirement
- Owner and status
- Gap plan with dates
Part of NIS2 and DORA readiness.
Ask about the control gap register
Tell us which systems it should cover. We reply with the access we would need and what the first version would contain.
Ask about this deliverable
A written reply, no call needed.