Starting assessment

Starting assessment: applicable frameworks, maturity area by area on five levels, priorities.

A high-level assessment built on the organisation's profile: it identifies the frameworks that apply, measures maturity area by area and shows where to start. It forms the basis for the next steps.

Request the assessment

Questions that change by sector and framework
A five-level scale, not yes or no
A report with priorities, not a score

How it works

Three parts: the profile determines the frameworks, the frameworks determine the areas assessed.

Profile

Sector and activities, size, group structure, ICT services, use or development of AI systems, products with digital elements.

OutputThe frameworks that apply: NIS2 and category, DORA, the AI Act, GDPR, the Cyber Resilience Act.

Maturity

Only the areas covered by the applicable frameworks: governance, risk management, incidents, continuity, vendors, access, training.

OutputThe level of each area, from "does not exist" to "verified with evidence".

Context

Known deadlines, existing certifications, tools used today, who looks after compliance.

OutputPriorities, first steps and an estimate of the effort.

The result

The report: applicable frameworks, the level of each area, priorities with an effort estimate.

The report sets out the frameworks that apply, the level of each area and priorities with an effort estimate. It takes about ten minutes to read and is laid out for presentation to the management body.

Starting assessmentSample companyManufacturing · 240 employees · September 2026

EVIDEVO

Applicable frameworks

NIS2Important entity
GDPRData controller
CRATo be confirmed: products with software
DORANot applicable

Maturity by area

GovernanceDocumented
Risk managementInformal
IncidentsInformal
Continuity and backupDocumented
VendorsNone
AccessApplied
TrainingInformal

First priorities

1
Register and assessment of critical vendorsMedium effort · 6 weeks
2
Incident notification procedure, 24/72 hoursLow effort · 3 weeks
3
Risk analysis method approved by the boardMedium effort · 8 weeks

Data for illustrative purposes only, not real

The scale

A five-level scale: a policy that is documented but not applied stops at level 3.

Every answer states the level reached. The scale separates what is written, what is applied and what is demonstrated with evidence.

1Does not exist
2Informal
3Documented
4Approved and applied
5Verified with evidence

And then

The profile gathered in the assessment is the basis for the controls in EVIDEVO.

The profile gathered here is the same one EVIDEVO uses to build tailored controls. Starting with the assessment means the platform is already being configured, whichever route the organisation then takes: in-house, with a professional or by handing compliance to the EVIDEVO team.

How it works today

The assessment is carried out with an EVIDEVO specialist, who walks through the report and explains the priorities. A self-service version is being prepared.

Request the assessment

Confidential answers

Answers describe security weaknesses, so they are treated as confidential.
They stay in the European Union and are not shared with third parties.
They are deleted on request via [email protected].

The starting assessment is a high-level first look: it does not replace a full assessment, an audit or legal advice.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk