How we score the readiness assessments — methodology

Where do the questions come from?

Each assessment is built from the official text of one EU directive, as published in the Official Journal of the European Union. Every question names the article it is based on, and the explanation you see in the result paraphrases that article without adding to it. Where we add a common-sense reading, it starts with “In practice”.

The assessments check the directive, not the national law of any one country. National laws have to include the directive's requirements but may go further, so the result shows where you stand against the EU minimum.

What do the answer levels mean?

All assessments use one four-level scale. A level is not only a mark; it also says what to do: the first two mean something needs writing down, the third means putting it into practice, the fourth means done.

We don't have it0 %

This does not exist at all. We would start from scratch.

Informally40 %

We do it somehow, but nothing is written down. It depends on one person and varies every time.

On paper70 %

It is written down, but in practice everyone does it their own way and records are missing.

Works, with evidence100 %

It is written down, people follow it and we keep records we can show.

Some questions offer “doesn't apply to us” — for example incident reporting to an authority, which only applies to companies NIS2 covers directly. Such answers are left out of the score.

How are the score and the band calculated?

The score is the average percentage of all scored answers, rounded to a whole number. Higher is always better. Questions about your company, such as size or sector, do not count towards the score.

Each area has its own percentage, calculated the same way from its questions. The score is not the average of the areas: otherwise an area with two questions would weigh as much as one with four.

The band follows from score thresholds, with two safeguards against an average that looks good over empty spots. If at least a third of the answers are “we don't have it”, the band drops to the lowest. If there are at least three such answers, it cannot be the best.

What is the company type?

Two companies with the same score can be in very different situations. The company type therefore comes from the pattern of answers, not the number: whether missing documents dominate, whether practice lags behind what is written, or whether the gap between the strongest and weakest area is large. It also decides what to start with — there is no point recommending more documents to a company that has them but does not follow them.

What do we store?

After the last question we store the answers, the score, the band and the calculated values, with no contact details. Your email address is attached only if you ask for the full report. Anonymous results may be used to describe how companies typically score; such summaries never contain the answers of an individual company.

What we deliberately don't do

• We don't hide the result behind an email. You see all of it straight after the last answer.
• We don't promise compliance. The assessment is a self-assessment, not an audit or legal advice.
• We don't let our product change the score. Aptien is our product and we suggest it where it helps, but neither the score nor the order of the gaps depends on what Aptien can do.

Which assessments follow this method?

• EU Pay Transparency DirectiveHR · 12 questions · 3 min
• NIS2 readinessCybersecurity · 15 questions · 4 min