Cyber Governance module
Answer the controls once, and see where you stand against every cyber regime that reaches you.
Self-guided, or with advisors at the ready.
NIS2, DORA, the SEC cybersecurity rules, ISO 27001 and NIST CSF 2.0 share one set of 25 controls and differ in how much of it they reach. You pick the frameworks that apply to you, answer once, and only those controls are scored.
DORA does not switch NIS2 off
Where a sector-specific Union act imposes at least equivalent requirements, art. 4(1) disapplies the relevant provisions of NIS2 to the entities it covers, including the supervision and enforcement provisions in Chapter VII. Art. 4(2) sets the equivalence test by reference to art. 21(1) and (2) for cybersecurity risk-management measures and art. 23(1) to (6) for incident notification. NIS2 does not cease to apply: what is displaced is the provisions the sector-specific act replaces, not the Directive.
An entity identified as essential or important submits to its Member State, under art. 3(4), its name, address and up-to-date contact details, the relevant sector and subsector, and the Member States where it provides services. Changes are notified without delay, and in any event within two weeks. Member States were to establish the list of these entities by 17 April 2025.
How people arrive here
What the module covers
- The control set
- 25 controls across eight domains: governance, risk management, access control, incident response, supply chain security, technical controls, business continuity, and training and awareness.
- NIS2
- Scores you against the 19 controls it reaches, including the two it alone requires: a maintained asset inventory, and a documented notification procedure for the 24-hour early warning and 72-hour full report.
- DORA
- Scores you against the 21 controls it reaches, the widest of the three regimes, including its four unique ones: incident classification, resilience testing, an access review process, and the critical third-party provider register.
- SEC cybersecurity rules
- Scores you against the 5 controls they reach, the narrowest of the three, four of which are shared with NIS2 and DORA. The one they alone require is the 8-K materiality assessment.
- ISO 27001 and NIST CSF 2.0
- Scored as well, against 20 and 19 of the controls. Both are voluntary, and both are commonly asked for by customers rather than by a regulator.
- Maturity, not yes or no
- Each control is recorded as not implemented, partially implemented, fully implemented, or optimised and tested, so partial progress counts as partial rather than as nothing.
- What to fix first
- Gaps are ranked by the priority weight on the control, and the top five are listed on their own so a remediation plan has somewhere to start.
How it works
- You bring
- Answers about the controls you already have, one screen at a time.
- ThemisIQ applies
- The controls each framework reaches, so answering once scores you against all of them at the same time.
- You get
- A score by domain, your gaps ranked by priority, and a spreadsheet showing how every score was reached.
How you stand behind it
Every control keeps the maturity you recorded, the frameworks that reach it and the priority weight behind its ranking, so a score can be traced to the answers that produced it rather than to a judgement nobody wrote down.
Nothing is a black box. Every score carries the inputs and the method that produced it, so a reviewer can follow the reasoning rather than taking the number on trust.
What the module produces
You can work through the whole assessment and see your results before buying anything.
What it satisfies
Each of these is described, sourced and mapped to a module on the regulations page.
Pricing
One flat annual price.
Add modules and the multi-module discount applies automatically: two modules −10%, three or more −20%.
