NIS2xlsx

NIS2 Compliance Checklist

Download the NIS2 review workbook, or start with a short online readiness check. The workbook covers a wider scope than the check.

Updated 21 September 2026

Start free NIS2 assessment Download XLSX

No account required · Autosaves in this browser for 30 days · Sign up only to keep it

What's Inside

NIS2 review entries grouped by topic, with article references and descriptions

Controls sheet with descriptions and a filterable table

Status choices: Not Assessed, Compliant, Partially Compliant, Non-Compliant and Not Applicable

Evidence reference and gap-description columns

Priority, owner and target-date fields

Dashboard showing status counts and the percentage marked Compliant by category

From the Auditor's Bench

I think every company should keep an internal checklist. When someone hands me one with everything marked green, my first question is whether it belongs to a living review process. If it does, I ask for earlier checklists: who completed them, what changed between reviews, and what work closed the gaps.
Across 300 engagements, I have yet to see a company with everything in order. An all-green checklist makes me want to understand how the company reached that position. Periodic reviews, earlier versions and a log of actions taken give me more confidence. A one-off checklist with no trace of the work behind it makes me suspicious.
My job as an auditor is to find and verify answers. I want the company to show a coherent connection between each green mark and the work that supports it. A few red areas that have been identified and are being worked on do not undo the confidence that a well-evidenced review process earns.
If I find that topics marked green are actually unresolved, that affects my confidence in the company's other documents and claims too. Keep the history of your reviews and the actions taken between them. That history helps me assess whether the checklist reflects how the company actually operates.

Radoslaw Korbecki · Lead Auditor

About This Template

The workbook brings together NIS2 review topics under risk management, incident reporting, supervision and sector requirements. These are AuditFront review entries, not an official list of NIS2 controls. Establish whether your entity is in scope and which national law applies before treating any entry as an obligation. The file does not contain a country-by-country transposition tracker or an ISO 27001 mapping worksheet.

The file has two sheets: Controls and Dashboard. On Controls, choose a status and record the evidence reference, gap, priority, owner and target date. Keep the reference specific enough for another reviewer to find the same document or system record. If you have not checked an item, leave it as Not Assessed rather than treating the absence of a known problem as evidence that it is working.

The dashboard counts statuses by category. Its percentage is the share of listed entries marked Compliant; it does not measure legal compliance, audit success or the severity of outstanding issues. A single unresolved access or recovery problem can matter more than several completed documentation tasks. Review the findings alongside the count.

Use the workbook locally or keep it in your existing document process. The online assessment is a separate workflow. Paid template imports create question structure; completed answers, formulas, owners and attachments are not transferred automatically. Keep the original workbook as your working record if you choose to continue in the app.

Who It's For

CISOs and security managers at organizations classified as essential or important entities under NIS2Board members and executives reviewing cybersecurity governanceCompliance officers responsible for implementing NIS2 requirements at the organizational levelIT managers at mid-sized companies newly brought into scope by NIS2's expanded applicabilityConsultants and advisors helping clients prepare for NIS2 compliance

How It Works

Open the assessment

Start the short NIS2 readiness check. Use the workbook for a wider review.

Answer and see gaps

Work through each question and see your score, findings, and priorities.

Save your work

Your work autosaves for 30 days. Create a free account only to keep it or use another device.

Frequently Asked Questions

Is the workbook the same as the online readiness check?

No. The online entry is a short readiness check. The workbook supports a wider topic review and gives you fields for evidence, gaps, owners and dates.

Can I use it to decide whether NIS2 applies?

Use it to organise the review, then check the national rules, entity type, size and any exceptions that affect your organisation. The workbook cannot make that determination.

What should I do with an unanswered item?

Leave its status unresolved, name the person who can establish the answer and record the evidence needed. Missing information should not count as a positive result.

Ready to see where you stand?

Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.

Start free NIS2 assessment

No account required · Autosaves for 30 days · No credit card