NIS2 Compliance Checklist

The NIS2 Directive represents the most significant overhaul of EU cybersecurity regulation in years, dramatically expanding the scope of organizations that must meet strict cybersecurity requirements. With fines reaching EUR 10 million or 2% of global annual turnover for essential entities — and personal liability for management bodies — the stakes for non-compliance are higher than ever. This NIS2 compliance checklist provides a structured approach to evaluating your organization's readiness against the directive's requirements as transposed into national law across EU member states. The checklist is organized around NIS2's core requirement areas as defined in Article 21: cybersecurity risk management measures, incident handling, business continuity and crisis management, supply chain security, security in network and information systems acquisition and development, vulnerability handling and disclosure, cybersecurity risk assessment practices, cryptography and encryption, human resources security and access control, and multi-factor authentication. For each requirement area, the template provides a clear explanation of the obligation, practical guidance on what constitutes compliance, a status assessment field, and space to document your current implementation and planned remediation actions. Beyond the technical requirements, the checklist addresses NIS2's governance and reporting obligations: management body accountability and training requirements, incident reporting timelines (24-hour early warning, 72-hour notification, one-month final report), registration with national competent authorities, and cooperation with CSIRTs. These procedural requirements are often overlooked but are critical for compliance — having strong technical controls means little if you cannot demonstrate proper governance or meet reporting deadlines during an incident.