Checklist

NIS2 checklist: the eight steps, and the evidence behind each one

A NIS2 checklist runs in eight steps, from working out whether you are in scope through to registering with your national authority, and every step needs evidence a supervisor can actually read. The second half is where it usually breaks down. The measures exist, the file does not.

Step 1: are you in scope?

Get this wrong and nothing downstream holds. Map the organization against the 18 sectors in Annexes I and II, and include subsidiaries, joint ventures and EU establishments of non-EU parents. Then test the thresholds: 50 employees or 10 million euro turnover, and 250 employees or 50 million euro. Use the European SME definition and count linked and partner enterprises.

One category is covered regardless of headcount or turnover: DNS providers, top level domain registries, cloud providers, data centres and CDN providers. Record your applicability conclusion in writing and set out the reasoning. Supervisors ask for it.

Step 2: Essential or Important?

That classification decides two things: your supervisory regime and your fine ceiling. Essential Entities sit under proactive supervision and face up to 10 million euro or 2 percent of global turnover. Important Entities sit under reactive supervision and face up to 7 million euro or 1.4 percent. Decide this per legal entity in scope, not for the group as a whole.

Step 3: where do you stand today?

Assess your position before you introduce new measures. A gap analysis maps every network and information system with its dependencies and data flows, puts existing policy next to the ten minimum measures, tests whether you can detect, report and recover inside the deadlines, examines supplier contracts and how you verify them, and checks whether the board is exercising oversight and has taken training. If you hold ISO 27001, point the analysis at the places where NIS2 goes further.

Step 4: what does Article 21 require?

Article 21 sets out ten minimum risk management measures. Proportionality applies, but every measure has to be covered explicitly. "We do not do that" is not an answer.

1. Risk analysis methodology and information system security policy, approved, versioned, reviewed annually.
2. Incident handling that works: detect, contain, eradicate, recover, with playbooks for your five most likely scenarios.
3. Business continuity, backup management, disaster recovery and crisis management, including a tested restore.
4. Supply chain security, aimed at your direct suppliers and service providers.
5. Security in acquisition, development and maintenance of systems, including vulnerability handling and patch windows.
6. Policies and procedures to assess the effectiveness of your measures.
7. Basic cyber hygiene and role-based training, including phishing simulations and training for privileged users.
8. Cryptography and encryption policy, at rest, in transit, and for key management.
9. Human resources security, asset management and access control, with joiner, mover and leaver processes.
10. Multi-factor authentication and secured communications, with phishing-resistant factors for administrators.

Step 5: can you meet the reporting deadlines?

Article 23 sets three moments and they are fixed. What you need is not only knowledge of the deadlines but the machinery behind them: a written definition of "significant incident" for your entity, templates ready to go, a named owner, and a contact roster you test every quarter outside office hours.

Step 6: do you have your supply chain in view?

Article 21(2)(d) extends your obligations to suppliers. You need a complete supplier inventory classified by criticality, covering at minimum ICT, cloud, service providers and anyone with privileged access. Alongside it, an assessment methodology with clear evidence requirements, contract clauses on security, incident reporting and audit rights, ongoing monitoring with a fixed reconfirmation, and an exit plan for critical suppliers.

Watch one classic finding: procurement and security often keep two lists with two definitions of critical. That produces two different answers to the same supervisory question.

Step 7: is the board behind it, demonstrably?

Article 20 makes the management body personally accountable. Four things go with it: approve the risk management measures, oversee their implementation, take cybersecurity training, and accept liability for breaches of Article 21. Formally appoint a named member of the management body as NIS2 owner and minute it. Keep attendance and content for the training: a session without an attendance list is treated as a session that did not happen.

Step 8: are you registered?

Entities in scope register with their national competent authority, providing name and legal form, address and contact details, sector and subsector, the member states where they operate, IP ranges and a contact person. There is no EU-wide registration window and no EU-wide date for first checks: each member state sets its own in national law. In the Netherlands the registration duty applies from 15 August 2026, when the Cyberbeveiligingswet enters into force. Verify the date with your own national authority, because registering late is an infringement in its own right.

When is an item genuinely ticked off?

Under supervision what counts is not what you do but what you can show. A good test costs an afternoon: have someone who did not build the file ask for ten random artefacts and time how long each takes to produce. Anything over ten minutes earns an index entry. Record every gap you already know about, with an owner, a date and a plan. Declared gaps are managed risk. Discovered gaps are findings.

Frequently asked questions