What does the gap analysis measure?

• 169 controls in 24 sections, each weighted 1 to 5.
• Each control is answered on a six-step scale, with the current state, the evidence, the gap, the actions, the priority, the due date and the owner.
• On 23 controls the ΕΑΚ allows the answer "not applicable", and some controls apply to essential entities only.

When do you need it?

The KYA asks for the yearly self-assessment using the ΕΑΚ's guide (Article 18(1)(δ))^[2]. The gap analysis measures the KYA's measures one by one and gives the work plan: which gap is closed by whom and when. A customer, a consultant or an auditor can ask for either instrument.

How Vardion runs the gap analysis

• The 169 controls in the ΕΑΚ's original Greek, reproduced unaltered under cyber.gov.gr's CC BY-ND 4.0 licence, with the credit on every page.
• Scored by the method the ΕΑΚ documents: a control that does not apply leaves both the achieved and the maximum. Where the authority's workbook would show another figure, the page says so.
• Hand sections to the colleagues who know the answers and approve each answer before it counts.
• Each gap becomes programme work with an owner and a date, and each section shows Vardion's evidence beside it.
• Export in the columns of the ΕΑΚ's workbook.

Vardion works out the compliance figures from the organisation's answers by the method the ΕΑΚ publishes. They are not the authority's determination, and Vardion gives no legal advice.

See a sample

Open a sample export for an invented company, written by the same export code as the console: all 169 controls in the ΕΑΚ's columns and a sheet with the score by section.

What to do now

• Answer the governance and risk management sections first, since the others rest on them.
• Give each section to its owner with a date.
• Start the self-assessment alongside, which is sent to the ΕΑΚ.

Sources

1. ΕΑΚ, announcement of the compliance assessment tool for Law 5160/2024, 10 September 2025, with the workbook, checked 24 October 2026
2. KYA 1689/2025 (ΦΕΚ Β' 2186/2025), the authority's copy, checked 24 October 2026