← All checklists
NIS 2 readiness checklist
Every NIS 2 obligation an essential or important entity has to act on, mapped to its article and, for digital providers, to Implementing Regulation (EU) 2024/2690, with the evidence a competent authority will ask for. Preview 13 of the 74 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers NIS 2 Directive (EU) 2022/2555Reviewed 30 Oct 202674 items · 8 sections
Scope, classification and registration
10 items
- Art. 2
(1) Check whether you operate in a sector listed in Annex I or II and meet the medium-sized enterprise threshold (50 or more staff, or annual turnover and balance sheet above EUR 10 million).Evidence: Scoping memo with sector mapping and headcount and financial figures. - Art. 2
(2) Check whether you fall in scope regardless of size, for example as a DNS provider, TLD registry, qualified trust service provider or public electronic communications provider.Evidence: Scoping memo section on size-independent categories.
Management accountability
6 items
- Art. 20
(1) Have the management body approve the cybersecurity risk-management measures and oversee their implementation. Members can be held liable for failures.Evidence: Board minutes approving the measures and periodic oversight reports.
Risk analysis and effectiveness
6 items
- Art. 21
(2) Maintain policies on risk analysis and information system security.Evidence: Risk management policy and current risk assessment.(a)
Incident handling and business continuity
10 items
- Art. 21
(2) Maintain an incident handling process covering detection, analysis, containment, response and recovery.Evidence: Incident handling policy and runbooks.(b) - IR 2024/2690 3.2Monitor and log activity on networks and systems, protect logs and keep them long enough to investigate incidents.Evidence: Logging standard, SIEM coverage and retention settings.
Supply chain and secure development
12 items
- Art. 21
(2) Address security in relationships with direct suppliers and service providers.Evidence: Supplier security policy and contract clauses.(d) - Art. 21
(3) Consider each supplier's specific vulnerabilities, product quality and secure development practices.Evidence: Supplier risk assessments.
Cyber hygiene, people and access
12 items
- Art. 21
(2) Apply basic cyber hygiene practices and provide cybersecurity training.Evidence: Hygiene baseline and training program.(g) - IR 2024/2690 8.1Run awareness activities for all staff, including management, and measure their effect.Evidence: Awareness plan and phishing simulation results.
Incident reporting
11 items
- Art. 23
(3) Define what counts as a significant incident: severe operational disruption or financial loss, or considerable damage to others.Evidence: Significance criteria in the incident procedure. - IR 2024/2690 Art. 3For providers covered by the Implementing Regulation, apply its significance thresholds, such as financial loss or service unavailability limits.Evidence: Threshold table built into triage.
Supervision and enforcement
7 items
- Art. 32
(2) As an essential entity, be ready for on-site inspections, regular and targeted audits, security scans and information requests.Evidence: Audit-ready evidence pack and point of contact.
Changelog
- v1.030 Oct 2026First release. Covers Directive (EU) 2022/2555, including entity classification, registration, management accountability, the Article 21 measures, 24 hour, 72 hour and one month incident reporting, and Implementing Regulation (EU) 2024/2690 for digital providers.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.