Cybersecurity Gap Assessment & Independent Assessment Services

The European cybersecurity regulatory landscape is evolving rapidly. Organizations are facing new and overlapping requirements under the NIS2 Directive, DORA, Cyber Resilience Act (CRA), GDPR and the EU AI Act, alongside established international standards such as ISO/IEC 27001.

Understanding where your organization stands against these requirements is an essential first step toward strengthening cybersecurity resilience and preparing for certification, assessment or regulatory scrutiny.

Intertek provides independent assessment, gap assessment, audit, certification and training services to help organizations evaluate their current level of readiness and identify areas requiring further attention.

As an independent certification and assurance body, Intertek maintains impartiality and does not provide consultancy or implementation services that could create a conflict of interest with subsequent certification or independent assessment activities.

Why Conduct a Cybersecurity Gap Assessment?

A gap assessment provides an objective view of how existing policies, processes and controls compare with a defined standard, regulation or framework.

It can help organizations identify:

• Requirements that are already addressed
• Partially implemented controls
• Missing processes or capabilities
• Documentation and evidence gaps
• Governance and accountability weaknesses
• Areas requiring further improvement before formal assessment or certification

The result is greater visibility of your cybersecurity maturity and a clearer understanding of where additional action may be required.

Which Requirements Can You Assess Against?

Depending on your organization's sector, activities and objectives, assessments can consider requirements from a range of cybersecurity and information security frameworks.

NIS2 Directive
Assess organizational readiness against key NIS2 areas including:

• Cybersecurity risk management
• Incident handling and reporting
• Business continuity and crisis management
• Supply chain security
• Access control and authentication
• Vulnerability management
• Cybersecurity policies and training
• Management accountability

A NIS2 gap assessment can help organizations understand their current position before engaging with applicable national requirements or supervisory processes.

DORA
For organizations within the financial sector, assessment activities can consider areas such as:

• ICT risk management
• ICT-related incident management
• Digital operational resilience testing
• ICT third-party risk management
• Business continuity and recovery
• ICT governance and accountability

DORA assessments can help organizations evaluate their preparedness against the regulation and identify areas requiring further attention.

ISO/IEC 27001
ISO/IEC 27001 provides an internationally recognized framework for establishing an Information Security Management System (ISMS).

An ISO 27001 gap assessment can evaluate areas including:

• Information security governance
• Risk assessment and treatment
• Policies and procedures
• Statement of Applicability
• Information security controls
• Internal audit
• Management review
• Continual improvement

For organizations considering certification, a gap assessment can provide useful visibility before entering the formal certification process.

GDPR
Cybersecurity is an important component of GDPR compliance.

Assessment activities can consider areas such as:

• Technical and organizational security measures
• Access management
• Data protection controls
• Encryption
• Incident and breach management
• Third-party and processor security
• Data protection governance

ISO/IEC 27701 can also provide a structured framework for organizations seeking to strengthen their privacy information management.

Cyber Resilience Act
Organizations developing, manufacturing or distributing products with digital elements may need to consider CRA requirements relating to:

• Security-by-design and security-by-default
• Vulnerability management
• Security updates
• Product lifecycle security
• Incident and vulnerability reporting
• Technical documentation
• Conformity assessment

An assessment can help organizations identify areas requiring further preparation as the CRA requirements become applicable.

From Gap Identification to Improvement

A gap assessment should provide more than a simple list of deficiencies.

A structured assessment can help organizations understand:

Current State
Where are you today?

Requirements
What regulatory or standard requirements apply?

Gaps
Which requirements are not fully addressed?

Priorities
Which areas require the greatest attention based on risk and importance?

Readiness
Are you sufficiently prepared to proceed toward a formal audit, certification or regulatory assessment?

The purpose is to provide independent visibility, enabling the organization and its appointed internal or external resources to determine appropriate next steps.

Typical Areas Assessed

Depending on the scope and applicable framework, an assessment may consider:

Governance & Leadership

• Roles and responsibilities
• Management oversight
• Cybersecurity policies
• Risk appetite and governance

Risk Management

• Information security risk assessment
• Risk treatment
• Risk monitoring
• Integration with enterprise risk management

Technical & Organizational Controls

• Identity and access management
• Authentication and MFA
• Vulnerability management
• Encryption
• Security monitoring
• Asset management

Incident Management

• Incident detection
• Response procedures
• Escalation processes
• Regulatory reporting readiness
• Crisis communications

Business Continuity

• Backup and recovery
• Disaster recovery
• Business continuity planning
• Resilience testing

Supply Chain Security

• Supplier risk assessment
• Third-party security requirements
• ICT dependency management
• Ongoing supplier monitoring

People & Awareness

• Cybersecurity training
• Security awareness
• Competence requirements
• Management training

Documentation & Evidence

• Policies and procedures
• Risk records
• Audit evidence
• Control documentation
• Monitoring and measurement

Independent Assessment Matters

When organizations are preparing for certification or regulatory scrutiny, independence and impartiality are important.

Intertek's role as an independent certification and assurance organization means that our assessment activities are designed to provide an objective evaluation against defined requirements.

We do not implement the management systems, cybersecurity controls or remediation measures that we subsequently assess for certification where doing so would compromise impartiality.

This separation helps protect the integrity and credibility of the assessment and certification process.

Gap Assessment vs. Certification

A gap assessment and certification audit have different purposes.

A gap assessment should therefore not be presented as a certification audit or guarantee of future certification.

Beyond ISO 27001 Certification

ISO/IEC 27001 certification can provide a strong foundation for cybersecurity governance, but certification against ISO 27001 does not automatically mean that an organization complies with every applicable EU cybersecurity regulation.

For example:

• NIS2 includes specific incident reporting and management accountability requirements.
• DORA introduces financial-sector-specific operational resilience and ICT third-party requirements.
• CRA introduces product-level cybersecurity and lifecycle requirements.
• GDPR includes specific privacy and personal data protection obligations.
• The AI Act introduces requirements related to AI governance and risk management.

Organizations should therefore consider the specific regulatory requirements applicable to their activities, even where an ISO management system is already in place.

Intertek Cybersecurity Assessment Services

Intertek can support organizations through independent assessment and assurance activities, including:

Cybersecurity Gap Assessments
Evaluate current practices against selected cybersecurity standards, regulations or requirements.

ISO/IEC 27001 Certification
Independent certification of Information Security Management Systems against ISO/IEC 27001 requirements.

ISO/IEC 27701
Assessment and certification services supporting Privacy Information Management Systems.

ISO/IEC 42001
Assessment and certification of Artificial Intelligence Management Systems.

Internal Audit Training
Training organizations and personnel in effective internal audit approaches for relevant management systems.

Cybersecurity Awareness Training
Training for employees, management and boards covering cybersecurity risks, responsibilities and regulatory developments.

Regulatory Readiness Assessments
Independent assessment activities designed to help organizations understand their current readiness against applicable regulatory requirements.

Training for Boards and Employees

Cybersecurity resilience depends not only on technology and processes, but also on people.
Intertek can provide training and awareness programs covering areas such as:

• Cybersecurity fundamentals
• Regulatory cybersecurity requirements
• NIS2 awareness
• DORA awareness
• Information security management
• Cybersecurity responsibilities for management
• Supplier and third-party security
• Incident response awareness
• AI and cybersecurity risks

Training can be tailored to different audiences, from employees and operational teams to senior management and board members.

Who Can Benefit?

Intertek's independent assessment and assurance services can support organizations across sectors, including:

• Manufacturing
• Technology and software
• Financial services
• Healthcare
• Energy and utilities
• Transport and logistics
• Retail and consumer services
• Automotive
• Professional and business services
• Organizations operating critical or important services

The applicable requirements depend on the organization's activities, size, sector and role within the relevant supply chain.

A Structured Path to Cybersecurity Readiness

Organizations do not need to address the evolving regulatory landscape through disconnected compliance projects.

A structured approach can help:

1. Identify applicable requirements
Determine which regulations, standards and industry requirements apply.

2. Assess current readiness
Evaluate existing governance, processes, controls and evidence.

3. Identify gaps
Determine where requirements are not fully addressed.

4. Prioritize areas for improvement
Use the assessment findings to determine where additional action is required.

5. Strengthen your management system and controls
The organization can then undertake appropriate improvement activities through its own resources or independently appointed advisers.

6. Evaluate readiness for formal assessment
When appropriate, proceed toward certification or other formal conformity assessment.

Why Choose Intertek?

Intertek combines international reach with technical expertise across cybersecurity, information security, management systems and regulatory requirements.

Our independent assessment and certification approach can help organizations:

• Gain an objective view of cybersecurity readiness
• Understand requirements across multiple frameworks
• Identify potential gaps before formal assessment
• Strengthen audit preparedness
• Demonstrate commitment to cybersecurity and resilience
• Build confidence among customers, partners and stakeholders

Start Your Cybersecurity Readiness Journey

The first step toward stronger cybersecurity resilience is understanding where you stand.
Whether you are preparing for NIS2, DORA, ISO/IEC 27001, GDPR, CRA or other cybersecurity requirements, an independent assessment can provide valuable insight into your current readiness.

Talk to Intertek about your cybersecurity assessment needs.