NIS2 Compliance Checklist Template

What the NIS2 Compliance Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope, Classification & National Law

   5 tasks

   Answers in this phase drive the conditional tasks in Phases 2, 4 and 7.

   • Map each legal entity to an Annex I or II sector and a size band — sector, entity type, headcount, turnover and balance sheet
   • Check the size-independent triggers in Article 2(2) to 2(4) — trust services, DNS, TLD registries, domain registration, telecoms, sole providers, critical entities
   • Confirm whether DORA displaces NIS2 for any entity in the group — financial entities follow DORA’s ICT risk and incident rules instead
   • Identify the national law, competent authority and CSIRT in each country — plus national additions, and the Article 26 main establishment rule for digital providers
   • Record the entity as essential or important, with the reasoning — authorities keep their own list and review it at least every two years (Article 3(3))
2. 2
   Phase 2

   Phase 2: Registration & Contact Details

   4 tasks

   The registry task appears only for the digital provider types listed in Article 27.

   • Register with each competent authority through its national mechanism — contact details, IP ranges, sector and member states served (Article 3(4))
   • Submit the Article 27 registry details — main establishment or EU representative, member states served and IP ranges, for ENISA’s registry
   • File the authority’s confirmation or reference number — with a record of what was submitted and when
   • Set a trigger for changes to registered details — the Directive allows two weeks under Article 3(4) and three months under Article 27(3); national law may differ
3. 3
   Phase 3

   Phase 3: Management Body Approval & Training

   4 tasks

   Article 20 makes the management body approve the measures, oversee their implementation and answer for infringements.

   • Present the Article 21 measures to the management body for approval — the risk assessment, treatment plan and policies
   • Record the approval with its date, attendees and document versions — tying the decision to exactly what was approved
   • Agree how the body will oversee implementation — reporting cadence, metrics and presenter
   • Complete cybersecurity training for every management body member — mandatory under Article 20(2); national law sets the detail
4. 4
   Phase 4

   Phase 4: Article 21 Risk-Management Measures

   7 tasks

   Ten minimum measures, points (a) to (j), on an all-hazards basis. The last task appears only for providers covered by Implementing Regulation (EU) 2024/2690.

   • Run and document the cybersecurity risk assessment — point (a), with a risk treatment plan
   • Test incident handling, backups, disaster recovery and crisis management — points (b) and (c), each with a dated test
   • Evidence secure acquisition, development and vulnerability handling — point (e), including vulnerability disclosure
   • Confirm cyber hygiene, cryptography, HR security, access control and assets — points (g) to (i), including training and an asset inventory
   • Confirm MFA and secured communications where appropriate — point (j), including emergency communications
   • Assess whether the measures work — point (f): test controls, not just policies
   • Map controls to the Annex of Implementing Regulation (EU) 2024/2690 — the security policy and risk treatment plan are reviewed at least annually
5. 5
   Phase 5

   Phase 5: Supply Chain Security

   5 tasks

   • List the direct suppliers and service providers that affect your systems — point (d), including managed and cloud services
   • Assess each supplier’s vulnerabilities and security practices — product quality and secure development (Article 21(3))
   • Check the EU coordinated supply chain risk assessments — Article 21(3) requires their results to be considered
   • Add security terms to supplier contracts — incident notice, audit rights, vulnerability handling, subcontracting, exit
   • Send critical suppliers through a full vendor risk assessment — with a residual risk rating and an approver
6. 6
   Phase 6

   Phase 6: Incident Reporting Readiness

   7 tasks

   • Define what a significant incident means for the entity — severe operational disruption or financial loss, or considerable damage to others (Article 23(3))
   • Record the reporting route and test portal access — CSIRT or authority, form, named reporters and deputies
   • Assign owners for the 24-hour early warning and 72-hour notification — both run from becoming aware, nights and weekends included
   • Prepare templates for the final and progress reports — due one month after the notification
   • Set the rule for informing recipients of the service — who is told, by whom, and what they can do (Article 23(1) and (2))
   • Link the process to GDPR breach notification — personal data may also need a GDPR Article 33 report within 72 hours
   • Rehearse the reporting chain in a tabletop exercise — timing each stage against the deadlines
7. 7
   Phase 7

   Phase 7: Annual Review & Supervision Readiness

   6 tasks

   The audit and accountability tasks appear only when the entity is classified as essential. Important entities are supervised after the event under Article 33.

   • Track a corrective measure for every gap found — without undue delay, as Article 21(4) requires
   • Assemble the evidence pack an authority would request — policies, audit results and underlying evidence (Articles 32 and 33)
   • Prepare for regular and targeted security audits — Article 32(2)(b); the entity usually pays for a targeted audit by an independent body
   • Name the individuals accountable for compliance — Article 32(6) requires that they can be held liable
   • Re-check classification, registration and national law — size, services, countries and laws change
   • Present the annual review to the management body for re-approval — closing the Article 20 loop