Getting Started · For NIS2 and ISO 27001
Cyber Risk Assessment for NIS2
A reliable picture of your cyber risks in four to six weeks—with a prioritized roadmap that shows what needs to be done first and why. Methodology and measures aligned with ISO/IEC 27001, regulatory compliance mapped to NIS2/BSIG and your industry-specific requirements. All without interfering with your systems.
THE PROBLEM
Between a questionnaire and a major project, there is a lack of a reliable format.
Today, most organizations assess their cyber risk in one of three ways. Each provides a partial picture—none offers a solid basis for executive decision-making. The Cyber Risk Assessment bridges this gap: an independent, standards-based view of the entire cyber risk landscape—in weeks instead of months.
Self-disclosure
Checklists and questionnaires are quick to fill out, but lack an outside perspective: Evaluating yourself won't reveal your own blind spots. And a checked-off list doesn't tell you which risk needs to be addressed first.
Tech Test
Scans and penetration tests are valuable, but selective: they reveal technical vulnerabilities—not governance, reporting capabilities, emergency preparedness, people, or the supply chain. Nor do they provide a template for management decisions.
Major project
Traditional consulting engagements are thorough, but often drag on for months—leaving you with long lists of findings that no one has prioritized. By the time the report is delivered, the situation has already changed.
THE RESULT
A report that helps your management make informed decisions.
Written for two readers: executive management, who must make the decisions, and the IT and OT leaders, who implement them. The recommendations section is the most extensive part of the report—this is where its true value is determined.
Excerpts from the sample report
The five greatest risks, the risk matrix featuring all 19 risks, and the roadmap of action packages—from a fully developed sample report for a fictional municipal utility. We would be happy to share the complete 22-page document with you in a consultation.
Executive Summary
Overall risk profile, top 5 risks, and the next 90 days across two pages - jargon-free and easy to read.
Risk Analysis & Risk Register
External threat landscape, scenarios, and detailed findings across all ten domains. Each risk is mapped in the matrix and backed by its source.
Action Packages & Roadmap
Prioritized packages with target horizons, effort, and responsibilities – quick wins first, implementable with internal teams, third parties, or with us.
Residual Risk & Acceptance Template
The residual risk remaining after implementation, transparently presented. Formal acceptance by management provides demonstrable proof of compliance with their obligations under Section 38 of the German Federal Office for Information Security Act (BSIG).
Final Presentation
The results presented in person to the executive board, with time for questions—by the very person who gathered the findings.
Four-eyes principle review
No report leaves Entropy CS without quality assurance by a second qualified expert: ensuring consistency, evidence, and feasibility of recommendations.
WHAT WE CHECK
Ten assessment domains across six topic areas - 80 guiding questions, the entire cyber risk picture.
Eight guiding questions per domain with defined evidence, evaluated based on events and assets in accordance with ISO/IEC 27005 guidelines. The guiding questions serve as a discussion framework, not a checklist to tick off—we investigate anomalies in depth. Calibrated to the current threat landscape for your sector.
CLEAR SCOPE
Aligned with the 93 controls of ISO/IEC 27001 Annex A.
Annex A divides all reference measures into four thematic areas. Every recommendation in the report is mapped to this framework—so you know upfront where the assessment focuses its efforts.
37
Measures · Chapter 5
Organizational
Policies, Roles, Risk Management, Vendors, Incident Management, Continuity, Compliance
Focus
8
Measures · Chapter 6
Staffing
Review, Obligations, Awareness, Reporting Channels, Responsibilities, Offboarding
Focus
34
Measures · Chapter 8
Technological
Access and identities, networks, vulnerabilities, logging, backup, cryptography, secure configuration
Focus
14
Measures · Chapter 7
Physical
Only where physical measures directly protect IT and OT: access to IT and technical rooms, utilities, data storage media, disposal
pro rata
Physical security remains a separate discipline. We do not assess facility protection, natural hazards, or resilience under the KRITIS Umbrella Act. Where findings intersect with these areas, we identify the interface in the report and recommend who should address it.
HOW IT WORKS
Six phases, four to six weeks.
One schedule, a single point of contact from kickoff to presentation. Your internal effort is typically three to four person-days, primarily for interviews. Data is gathered through documents, discussions, and an on-site walkthrough—with no scanning of your own and no interference with active systems.
01
Scope and schedule, non-disclosure agreement, clarification of data processing. You will receive the list of required documents - what you already have is sufficient.
02
Workshop with executive management and IT/OT leaders: critical processes, regulatory classification by division, shared risk criteria, and evaluation scales.
03
Review of your documents, six to eight interviews, inspection of the control center and technical rooms, evaluation of existing scan and test reports.
04
Threat landscape for your sector, risk scenarios, and detailed assessment along critical assets—mapped in a 5x5 matrix with four acceptance zones.
05
Action packages per risk with effort, responsibility, and reference to ISO/IEC 27001 Annex A and BSIG or EnWG - organized by quick wins, six months, and 12-24 months.
06
Quality assurance following the four-eyes principle, then the final presentation to executive management – by the person who also collected the data.
WHO IS IT SUITABLE FOR
For healthcare, utilities, and industry.
For organizations newly covered by NIS2 or facing special obligations as operators of critical facilities—especially where there is no dedicated security team managing the risk posture. We calibrate scenarios and the threat landscape specifically to your sector.
Hospitals and Clinics
Medical devices, legacy systems, and 24/7 operations: a risk profile that puts critical care delivery and reporting capabilities front and center.
Care and Practices
Distributed locations, specialized software, and service provider access: clear priorities instead of long lists of findings – tailored for organizations without dedicated IT security teams.
Medical Technology and Pharmaceuticals
Development, production, and supply chain: Risks assessed in accordance with ISO/IEC 27001 – seamlessly compatible with your ISMS and your customers' requirements.
Municipal Utilities and Energy Suppliers
Multiple sectors, multiple regulatory frameworks: classification according to BSIG and EnWG per sector, with a focus on control systems and remote maintenance.
Water and Wastewater
Small teams, distributed systems, telecontrol technology: a pragmatic risk profile with a roadmap that fits your resources.
Industry and Production
Office IT, manufacturing, and supplier access: evaluated risks for production and delivery capability—as a foundation for customer audits and ISO 27001.
AFTER THE ASSESSMENT
From risk profile to ongoing operations – if you wish.
The assessment is a snapshot in time; security is an operational state. Where recommendations align with our portfolio, we offer implementation as an option—not a requirement. The report recommends what works, not what we sell. The annual reassessment uses the same methodology while also evaluating the progress of your roadmap.
YOUR ENTRY
Risk Check or Cyber Risk Assessment?
Two formats, clearly separated: The Risk Check is an initial assessment conducted through a discussion. The Cyber Risk Assessment is a project with a comprehensive audit catalog, on-site inspection, and a reportable result. The path forward: Risk Check, scope definition, fixed-price proposal with schedule.
Free · 30 minutes
Free Risk Check
A 30-minute consultation with a security expert, followed by a brief written report covering maturity level, risk areas, and immediate actions. No obligation — the standard first step.
Fixed price · 4-6 weeks
Cyber Risk Assessment
Ten audit domains, interviews, and on-site walkthroughs – methodology and measures in accordance with ISO/IEC 27001. Including risk register, prioritized roadmap, and sign-off template for executive management.
The questions we hear from managing directors, IT leaders, and information security officers about cyber risk assessment. Feel free to ask further questions in the free Risk Check.