How to use this checklist. Work top to bottom. Mark items as done, in progress, or not applicable. Anything unchecked after your first pass is a gap. Bring the gaps to your next risk committee or board meeting.
1 Scope Assessment
Confirm whether NIS2 applies, and at which tier. If you get this wrong, everything downstream is wrong.
Include subsidiaries, joint ventures, and EU branches of non-EU parents.
Use the EU SME definition. Aggregate linked and partner enterprises.
These are in scope regardless of headcount or turnover.
Determines fine exposure (up to 10m/2% vs 7m/1.4%) and supervisory regime.
Cross-border operations can require registration in multiple Member States.
Evidence your reasoning. Regulators will ask.
2 Governance and Management Accountability
NIS2 Article 20 makes the management body personally accountable. This section is about making that accountability real.
Named individual, documented in board minutes.
Board minutes must show review and sign-off on Article 21 measures.
Keep attendance records and training content. NIS2 requires this on an ongoing basis.
Roles, escalation paths, reporting cadence, and committee mandates.
Quantified where possible. Reviewed annually.
KRIs, incidents, supplier issues, control effectiveness.
3 Article 21 Technical Measures
The ten minimum measures. Proportionality applies, but every measure must be addressed explicitly. "We don't do that" is not an answer.
Approved, versioned, reviewed annually.
Runbooks for top 5 scenarios. Tested at least annually.
Includes tested restoration from immutable or offline backups.
Not the same as BCP. Focus is decision making under duress.
Secure SDLC, vulnerability management, patching SLAs.
Includes a coordinated vulnerability disclosure policy.
Control testing, internal audit, or independent assurance.
Includes phishing simulations and privileged-user training.
Aligned to ENISA guidance or an equivalent standard.
Joiner/mover/leaver processes, least privilege, periodic access review.
Phishing-resistant MFA for admins (FIDO2, hardware tokens).
Encrypted channels for incident and crisis communications.
4 Incident Reporting
The 24 / 72 hour / one month cadence is non-negotiable. Build the machinery, then rehearse it.
Calibrated to your sector and the Member State implementing act.
Template drafted, owner named, escalation path tested.
Includes cross-border impact assessment where relevant.
Formal post-incident review signed off by incident owner.
Test out-of-hours reachability quarterly.
Aligns with NIS2, GDPR, and any sector-specific obligations.
Include legal, comms, board, and at least one Member State authority simulation.
5 Supply Chain Security
Article 21(2)(d) extends your obligations to suppliers. Your regulator will audit how you manage third parties.
Especially ICT, cloud, MSP, and any supplier with privileged access.
ISO 27001, SOC 2, or equivalent. Plus bespoke controls where needed.
Include obligations flowing down to their subcontractors.
Annual for critical suppliers, on material change otherwise.
Including realistic migration timelines and data-repatriation terms.
6 Training and Awareness
NIS2 explicitly treats training as a control, not a nice-to-have.
Minimum hours and content per role, tracked per person.
Evidence retained for supervisory inspections.
Link results into role-based retraining.
Secure coding, admin-account hygiene, incident escalation.
7 Ongoing Compliance
NIS2 is not a project, it is a regime. These items keep the organization compliant year after year.
2026 window: 1 January to 28 February 2026.
Findings reported to the management body.
Policies, minutes, training logs, incident reports, supplier attestations.
Trigger reviews on org change, new systems, or regulatory updates.
Quarterly update to the risk committee.
Move from "compliant" to "defensible and resilient".
Independent eyes on your own homework.
Need help implementing this?
Book a call with Burak Yazici, PECB Certified NIS2 Lead Implementer. No pitch deck, just a conversation about where you are and the shortest route to compliant and defensible.