NIS2 compliance checklist: a practical path to audit-ready

Why the checklist is worth working through

Article 34(4) of Directive (EU) 2022/2555 requires national maximum administrative fines for an essential entity infringing Article 21 or 23 at a maximum of at least EUR 10 000 000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which it belongs, whichever is higher. Article 34(5) sets EUR 7 000 000 or 1.4% for important entities. The checklist helps organise risk reduction and evidence; it does not determine the outcome of supervision.

Step 1 – settle scope and get registered

• Confirm scope under Article 2 and classify under Article 3(1); an in-scope Annex I or II entity outside that class is important under Article 3(2). The full test is in the scope guide.
• Check the national list. Article 3(3) required Member States to establish lists of essential and important entities by 17 April 2025, reviewed at least every two years.
• Submit the Article 3(4) data: name, address, contact details including email addresses, IP ranges and telephone numbers, the sector and subsector, and the Member States where you provide in-scope services.
• Give someone named responsibility for notifying changes within two weeks, as Article 3(4) requires.

Step 2 – put the management body on the hook

The step most often treated as a formality is the one with personal consequences. Article 20(1) requires management bodies to approve the cybersecurity risk-management measures taken to comply with Article 21, to oversee their implementation, and states they can be held liable for the entity’s infringements.

Article 20(2) requires management body members to follow training, and has Member States encourage entities to offer similar training to employees regularly. That distinction concerns Article 20(2). Article 21(2)(g) separately requires cybersecurity training within the risk-management measures, so employee training is not simply optional.

• Get formal, minuted approval of the Article 21 measures – not a note that the board was briefed.
• Set a recurring oversight item with real reporting behind it: open gaps, test results, incidents.
• Book and record management-body training under Article 20(2), and keep the attendance evidence.
• Run staff awareness and role-specific training. Where Implementing Regulation (EU) 2024/2690 applies, map these to Annex sections 8.1 and 8.2.

Step 3 – close the Article 21 gaps

Assess against the ten Article 21(2) measures and the national implementation – the readiness scorecard walks the same ten points if you want a starting picture. The 13 Annex sections of Implementing Regulation (EU) 2024/2690 provide more detailed requirements for its defined digital entity types. The mapping below is binding only where that Regulation applies; others should treat it as a reference, not substitute it for their sector rules.

• Risk analysis and information system security policies – Art 21(2)(a); IR Annex 1 and 2, with 2.2 compliance monitoring and 2.3 independent review.
• Incident handling – Art 21(2)(b); IR Annex 3, with 3.4 event assessment and classification and 3.6 post-incident reviews.
• Business continuity, backups, disaster recovery, crisis management – Art 21(2)(c); IR Annex 4.2, which requires copies held outside the system network, far enough away to escape a disaster at the main site.
• Supply chain security – Art 21(2)(d); IR Annex 5.2 supplier directory. Article 21(3) requires a judgement on each direct supplier, including secure development procedures – and the Verizon 2026 DBIR now puts third-party involvement in 48% of all breaches.
• Acquisition, development and maintenance, with vulnerability handling and disclosure – Art 21(2)(e); IR Annex 6.5, 6.6, 6.8, 6.10.
• Assessing effectiveness – Art 21(2)(f); IR Annex 7 and 6.5. See step 6.
• Basic cyber hygiene and training – Art 21(2)(g); IR Annex 8.1 and 8.2.
• Cryptography and encryption – Art 21(2)(h); IR Annex 9.
• HR security, access control and asset management – Art 21(2)(i); IR Annex 10.2, 10.4, 11.3, 12.3, 12.4.
• Multi-factor authentication and secured communications – Art 21(2)(j); IR Annex 11.7, which ties authentication strength to the classification of the asset accessed.

One duty hides inside the assessment. Article 21(4) requires an entity that finds it does not comply to take corrective measures “without undue delay”, so a gap register with no owners and no dates is evidence against you. Each measure is unpacked in the Article 21 guide.

Step 4 – decide what “significant” means before you need to

You cannot rehearse a 24-hour deadline if nobody can say what starts the clock. Article 23(3) gives the test that applies to everyone: an incident is significant if “it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned”, or if “it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage”.

Article 3(1) of Implementing Regulation (EU) 2024/2690 makes that concrete for the digital entity types it binds: direct financial loss exceeding EUR 500 000 or 5% of total annual turnover in the preceding financial year, whichever is lower; exfiltration of trade secrets; the death of a natural person; considerable damage to a person’s health; or “a successful, suspectedly malicious and unauthorised access … capable of causing severe operational disruption”. Recurring incidents (Article 4) and sector-specific criteria (Articles 5 to 14) also count; Article 3(2) excludes scheduled maintenance.

Those thresholds legally bind only the listed digital entity types. Other organisations must use their applicable sector and national criteria. These examples can inform a discussion, but importing the financial threshold could wrongly exclude a significant incident.

Step 5 – the reporting clock

Article 23(1) requires notification of the CSIRT or competent authority “without undue delay” for any incident with a significant impact, and adds a line worth quoting to nervous executives: “The mere act of notification shall not subject the notifying entity to increased liability.”

NIS2 incident reporting deadlines

Deadline	What you file	Contents	Article
24 hours	Early warning	Whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have cross-border impact	Art 23(4)(a)
72 hours	Incident notification	Updates the early warning with an initial assessment including severity, impact and, where available, indicators of compromise	Art 23(4)(b)
On request	Intermediate report	Status updates requested by the CSIRT or competent authority	Art 23(4)(c)
One month after notification	Final report	Detailed description including severity and impact, type of threat or likely root cause, applied and ongoing mitigation measures, and any cross-border impact	Art 23(4)(d)
Ongoing at one month	Progress report, then final report	Progress report at the one-month point, final report within one month of the incident being handled	Art 23(4)(e)

Reporting is not purely a duty. Under Article 23(5) the CSIRT or competent authority shall respond “where possible within 24 hours” of the early warning with initial feedback and, on request, guidance, operational advice and technical support. And Article 23(2) requires you, where applicable, to tell affected service recipients what measures or remedies they can take against a significant cyber threat – draft that in advance, not during the incident.

Step 6 – evidence that the measures work

Article 21(2)(f) requires an assessment of effectiveness. For entities covered by the Implementing Regulation, Annex section 7 specifies what to measure, the methods, timing and responsibilities. The security-testing records required by section 6.5 are one contribution to that broader assessment.

Step 7 – keep it live

1. Review and update measures as risks and the business change.
2. Repeat testing and exercises on the frequency your own Annex 6.5 policy sets.
3. Rehearse the reporting flow with the people who would actually make the call.
4. Maintain the evidence pack – approvals, training records, test results, incident files.
5. Feed post-incident reviews back into the controls, per IR Annex 3.6.

Common pitfalls

• Treating NIS2 as a project rather than a programme, so the evidence goes stale.
• Controls that exist but are undocumented or untested – precisely what Article 21(2)(f) targets.
• Assuming you are out of scope without aggregating partner and linked enterprises into the size test.
• Management signing off without genuine oversight, when Article 20(1) provides that they can be held liable for the entity’s Article 21 infringements.
• A gap register with no owners or dates, against the Article 21(4) duty to correct without undue delay.
• No agreed significance threshold, so the organisation recognises its reporting duty late even though the clock may already be running.