NIS2 Compliance Checklist Template

Phase 1: Scope, Classification & National Law

Answers in this phase drive the conditional tasks in Phases 2, 4 and 7.

• Map each legal entity to an Annex I or II sector and a size band — sector, entity type, headcount, turnover and balance sheet
• Check the size-independent triggers in Article 2(2) to 2(4) — trust services, DNS, TLD registries, domain registration, telecoms, sole providers, critical entities
• Confirm whether DORA displaces NIS2 for any entity in the group — financial entities follow DORA’s ICT risk and incident rules instead
• Identify the national law, competent authority and CSIRT in each country — plus national additions, and the Article 26 main establishment rule for digital providers
• Record the entity as essential or important, with the reasoning — authorities keep their own list and review it at least every two years (Article 3(3))

Phase 2: Registration & Contact Details

The registry task appears only for the digital provider types listed in Article 27.

• Register with each competent authority through its national mechanism — contact details, IP ranges, sector and member states served (Article 3(4))
• Submit the Article 27 registry details — main establishment or EU representative, member states served and IP ranges, for ENISA’s registry
• File the authority’s confirmation or reference number — with a record of what was submitted and when
• Set a trigger for changes to registered details — the Directive allows two weeks under Article 3(4) and three months under Article 27(3); national law may differ

Phase 3: Management Body Approval & Training

Article 20 makes the management body approve the measures, oversee their implementation and answer for infringements.

• Present the Article 21 measures to the management body for approval — the risk assessment, treatment plan and policies
• Record the approval with its date, attendees and document versions — tying the decision to exactly what was approved
• Agree how the body will oversee implementation — reporting cadence, metrics and presenter
• Complete cybersecurity training for every management body member — mandatory under Article 20(2); national law sets the detail

Phase 4: Article 21 Risk-Management Measures

Ten minimum measures, points (a) to (j), on an all-hazards basis. The last task appears only for providers covered by Implementing Regulation (EU) 2024/2690.

• Run and document the cybersecurity risk assessment — point (a), with a risk treatment plan
• Test incident handling, backups, disaster recovery and crisis management — points (b) and (c), each with a dated test
• Evidence secure acquisition, development and vulnerability handling — point (e), including vulnerability disclosure
• Confirm cyber hygiene, cryptography, HR security, access control and assets — points (g) to (i), including training and an asset inventory
• Confirm MFA and secured communications where appropriate — point (j), including emergency communications
• Assess whether the measures work — point (f): test controls, not just policies
• Map controls to the Annex of Implementing Regulation (EU) 2024/2690 — the security policy and risk treatment plan are reviewed at least annually

Phase 5: Supply Chain Security

• List the direct suppliers and service providers that affect your systems — point (d), including managed and cloud services
• Assess each supplier’s vulnerabilities and security practices — product quality and secure development (Article 21(3))
• Check the EU coordinated supply chain risk assessments — Article 21(3) requires their results to be considered
• Add security terms to supplier contracts — incident notice, audit rights, vulnerability handling, subcontracting, exit
• Send critical suppliers through a full vendor risk assessment — with a residual risk rating and an approver

Phase 6: Incident Reporting Readiness

• Define what a significant incident means for the entity — severe operational disruption or financial loss, or considerable damage to others (Article 23(3))
• Record the reporting route and test portal access — CSIRT or authority, form, named reporters and deputies
• Assign owners for the 24-hour early warning and 72-hour notification — both run from becoming aware, nights and weekends included
• Prepare templates for the final and progress reports — due one month after the notification
• Set the rule for informing recipients of the service — who is told, by whom, and what they can do (Article 23(1) and (2))
• Link the process to GDPR breach notification — personal data may also need a GDPR Article 33 report within 72 hours
• Rehearse the reporting chain in a tabletop exercise — timing each stage against the deadlines