Technology Maturity Assessments
for European Businesses

The NIS2 Directive (Network and Information Security Directive 2) is EU legislation that came into force in October 2024, replacing the original NIS Directive. It significantly expands the scope of organisations covered, introduces stricter security requirements across 10 minimum security measures (including incident response, supply chain security, and access control), and increases penalties for non-compliance to up to €10 million or 2% of global turnover. A TACGauge cyber security maturity assessment benchmarks organisations against the NIS2 security requirements, identifying gaps and providing a prioritised roadmap for compliance.

DORA (Digital Operational Resilience Act) is EU regulation that became applicable in January 2025. It applies to financial entities including banks, insurance companies, investment firms, payment institutions, crypto asset service providers, and their critical ICT third-party providers. DORA mandates ICT risk management, incident reporting, digital operational resilience testing, and third-party risk management. TACGauge assessments help financial entities and their IT consultants benchmark ICT resilience maturity against DORA requirements.

Cyber Essentials is a UK government-backed certification scheme that helps organisations protect against common cyber threats. It covers five technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. TACGauge's cyber security maturity assessment covers these five domains and more, giving UK businesses a comprehensive picture of their security posture that goes beyond Cyber Essentials baseline requirements.

GDPR (General Data Protection Regulation) requires organisations to implement appropriate technical and organisational measures to protect personal data. TACGauge's Data Governance & Privacy assessment benchmarks organisations against data protection maturity controls including data classification, access controls, retention policies, breach detection and response, data subject rights processes, and privacy by design implementation — all directly relevant to GDPR Article 25 and Article 32 requirements.

For European businesses, the most relevant TACGauge assessments are: Cyber Security Posture (NIS2 and Cyber Essentials alignment), Data Governance & Privacy (GDPR compliance), Compliance Readiness (NIS2, DORA, and sector-specific regulation), Cloud Migration Readiness (EU cloud sovereignty and data residency considerations), AI Readiness (EU AI Act alignment), and M365 Security Posture. All 15 assessment types are available to European businesses and partners.

The EU AI Act, which came into force in 2024, establishes a risk-based regulatory framework for AI systems used in the EU. It classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes obligations on providers and deployers of high-risk AI systems. TACGauge's AI Readiness Assessment helps European organisations understand their current AI governance maturity and identify gaps relative to EU AI Act compliance requirements.