We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

ChecklistEU

NIS2 Compliance Checklist

A practical NIS2 checklist for confirming whether an entity is in scope, how it is classified, which governance and cybersecurity measures apply, and what evidence should be ready.

Based on Directive (EU) 2022/2555, Commission implementation material, Implementing Regulation (EU) 2024/2690, and ENISA technical implementation guidance.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
6 sections12 primary sources
Overview

Use this checklist only after identifying the legal entity and service. First determine whether the entity is outside scope or belongs to the defined by Article 3, and retain the Annex mapping, size or special-case route, Member State basis, and classification evidence. The remaining checks give legal, security, compliance, risk, operations, and management teams verifiable conditions, owners, and evidence for governance, Article 21 measures, Article 23 reporting, national implementation, and reassessment.

Section 1

1. Confirm NIS2 scope before assigning controls

Start with the legal scope test. NIS2 generally applies to public or private entities of a type listed in Annex I or Annex II that are medium-sized or larger and provide services or carry out activities in the Union. Article 2 also contains specific size-independent cases.

Do not treat sector labels as enough on their own. The checklist record should identify the entity, service, Member States, Annex sector or subsector, size-rule conclusion, and any special scope trigger or exclusion.

  • Record the legal entity, service line, Member States served, and whether services are carried out within the Union.
  • Map the activity to Annex I sectors of high criticality or Annex II other critical sectors.
  • Document annual work units, turnover, balance-sheet total, and partner or linked-enterprise aggregation to show whether the entity is medium-sized or larger, or cite the size-independent Article 2 trigger.
  • Check special cases for public electronic communications, trust services, DNS services, top-level domain name registries, domain name registration services, sole-provider status, systemic or public-safety impact, critical-entity status, and public administration.
  • Record any exclusion or Member State exemption basis separately from the scope conclusion.
  • Check whether an equivalent sector-specific Union act displaces only the overlapping Article 21 or Article 23 provisions under Article 4; do not treat sector regulation as a blanket NIS2 exemption.
Section 2

2. Classify the entity and registration evidence

After scope, classify the entity as essential or important. This drives supervision and enforcement handling, so the classification should be traceable to Article 3 rather than copied from an internal risk tier.

Keep registration information ready because Member States must maintain lists of and entities providing domain name registration services. Specified digital and ICT providers also have a separate Article 27 registry path. National mechanisms determine how information is submitted.

  • Classify essential entities under Article 3, including Annex I entities above the medium-sized ceilings and listed size-independent categories such as qualified trust service providers, top-level domain name registries, and DNS service providers.
  • Classify important entities where the entity is in Annex I or Annex II but does not qualify as essential under Article 3.
  • Prepare registration data: legal name, address, up-to-date contact details, relevant sector and subsector, and Member States where in-scope services are provided.
  • For Article 3 list information, notify changes without delay and within two weeks. For the specified Article 27 registry providers, notify changes without delay and within three months. Record which path and national mechanism apply.
  • Keep the classification rationale, sector mapping, and registration evidence with the compliance file.
Section 3

3. Put management-body governance on the checklist

NIS2 compliance is not only a security-team task. Article 20 requires management bodies of to approve cybersecurity risk-management measures, oversee implementation, and follow training.

The checklist should therefore include governance evidence that links board or executive approval to the Article 21 measure set and to the services affected by NIS2.

  • Identify the management body responsible for approving NIS2 cybersecurity risk-management measures.
  • Keep approval records for the Article 21 control baseline, material exceptions, remediation plans, and residual-risk acceptance.
  • Schedule management-body training and keep attendance or completion evidence.
  • Brief management on significant incidents, control-effectiveness results, and material supplier or service changes.
  • Assign named owners for legal interpretation, security implementation, operations, supplier risk, incident reporting, and evidence storage.
Section 4

4. Build the Article 21 cybersecurity measure baseline

Article 21 requires appropriate and proportionate technical, operational, and organisational measures to manage risks to network and information systems and to prevent or minimise incident impact.

Use one checklist row per measure family. Each row should show the risk it addresses, the control owner, implementation status, evidence, exceptions, review date, and management approval where needed.

  • Risk analysis and information system security policies: keep risk assessments, treatment plans, and residual-risk approvals.
  • Incident handling: document detection, analysis, containment, response, recovery, reporting, and lessons-learned procedures.
  • Business continuity, backup management, disaster recovery, and crisis management: keep plans, test records, recovery results, and updates after significant incidents or major changes.
  • Supply chain security: assess direct suppliers and service providers, supplier-specific vulnerabilities, product quality, cybersecurity practices, and secure development procedures.
  • Secure acquisition, development, and maintenance: include vulnerability handling and disclosure in product, system, and change workflows.
  • Control-effectiveness assessment: define what is measured, how it is measured, who is responsible, and when results are reported.
  • Cyber hygiene, cybersecurity training, cryptography, encryption where appropriate, human resources security, access control, asset management, multi-factor or continuous authentication where appropriate, and secure communications: keep implementation and exception evidence.
Section 5

5. Prepare the Article 23 incident-reporting path

The checklist should make incident reporting operational before an incident occurs. Article 23 requires notification of significant incidents to the CSIRT or competent authority and sets staged reporting points tied to awareness of the significant incident.

Keep authority reporting separate from recipient communications, law-enforcement escalation, public disclosure, and sector-specific reporting. Where appropriate, Article 23 requires recipient notice when a significant incident is likely to adversely affect the service and, where applicable, practical measures or remedies for recipients potentially affected by a significant cyber threat.

  • Define who can decide that an incident is significant because it has caused or is capable of causing severe operational disruption, financial loss, or considerable material or non-material damage to others.
  • Map the CSIRT or competent authority route, portal, backup contact, and internal approvers for each relevant Member State.
  • Prepare an early-warning template due without undue delay and within 24 hours of awareness, covering suspected unlawful or malicious cause and possible cross-border impact where applicable.
  • Prepare an incident-notification template due without undue delay and within 72 hours of awareness, covering updated information, initial severity and impact assessment, and available indicators of compromise.
  • For a trust service provider, use a 24-hour incident-notification deadline for a significant incident affecting trust services, rather than the general 72-hour limit.
  • Prepare intermediate-report, final-report, and ongoing-incident progress-report templates, including severity, impact, likely threat type or root cause, mitigation measures, and cross-border impact where applicable.
  • Add separate recipient-communication checks for a significant incident likely to adversely affect service provision and for a significant cyber threat that may require recipients to take protective measures.
  • For the provider types covered by Regulation (EU) 2024/2690, apply its horizontal, recurring-incident, and provider-specific significance criteria before closing the assessment.
Section 6

6. Close only with evidence and reassessment triggers

Close the review only when each conclusion has a cited reason and each action has an owner and evidence. The file should align scope, classification, Article 4 overlap, jurisdiction, registration, governance, controls, incident reporting, and national implementation.

Reopen the checklist when business facts change, not only on an annual calendar. New services, Member States, suppliers, infrastructure, incidents, acquisitions, or national transposition changes can alter the file.

  • Keep source URLs, short source quotes, article references, and approval notes with the checklist record.
  • Attach the entity scope memo, essential-or-important classification, registration information, Article 21 control matrix, Article 23 reporting workflow, and management-body approvals.
  • Track corrective measures without undue delay where an Article 21 gap is identified.
  • Set reassessment triggers for new or retired services, new Member States, supplier changes, major architecture changes, significant incidents, changes in national registration requirements, and authority feedback.
  • Keep source URLs and the date each time-sensitive national instruction was checked.
Recommended next step

This NIS2 checklist helps assign owners, evidence, and review triggers

Sorena can help convert this checklist into a cited NIS2 scope memo, Article 21 control matrix, Article 23 reporting workflow, and management-body evidence pack.

Research workflow
Open Research Copilot for NIS2

Ask questions tied to cited sources about NIS2 scope, Article 21 measures, Article 23 reporting, and implementation evidence using the cited sources on this page.

Explore next step
Talk to Sorena
Talk through NIS2 implementation

Review your NIS2 checklist, source gaps, control evidence, and incident-reporting workflow with Sorena.

Explore next step
Primary sources

References and citations

ENISA NIS2 Technical Implementation Guidance
enisa.europa.eu4 citations
Referenced sections
  • ENISA guidance for implementing Regulation (EU) 2024/2690, with practical advice, evidence examples, and mappings to standards and frameworks.
  • Provides implementation guidance and evidence examples for governance, awareness, roles, responsibilities, and management reporting under the implementing regulation.
  • Non-binding guidance for applying the implementing regulation, including practical advice and examples of evidence.
Show 1 more
  • Supports evidence planning, monitoring, review, and update practices for the implementing regulation's technical requirements.
"practical advice, examples of evidence, and mappings of security requirements"
More quoted passages
"members of management bodies"
"examples of evidence"
"planned intervals"
European Commission - NIS2 Directive overview
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission overview for NIS2 policy context, scope expansion, sectors, reporting requirements, CSIRTs, and EU-CyCLONe.
  • Commission overview explaining the wider NIS2 scope and sector coverage.
  • Explains that NIS2 divides entities into essential and important categories with different supervisory regimes.
"wider scope, clearer rules and stronger supervision tools"
More quoted passages
"wider scope"
"essential and important entities"
Commission Implementing Regulation (EU) 2024/2690
eur-lex.europa.eu2 citations
Referenced sections
  • Technical and methodological cybersecurity risk-management requirements for specified NIS2 digital and ICT service entities.
  • Technical and methodological Article 21 requirements for specified digital infrastructure, ICT service management, digital provider, and trust service entities.
"technical and methodological requirements"
European Commission - NIS2 Directive FAQs
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission Q&A covering NIS2 scope, security requirements, incident reporting, supervision, and enforcement.
  • Commission Q&A explaining the multi-stage incident reporting approach and relationship to authorities.
"The early warning should be followed by an incident notification"
Directive (EU) 2022/2555 (NIS2)
eur-lex.europa.eu
Referenced sections
  • Primary legal text for NIS2 scope, entity classification, governance, Article 21 cybersecurity measures, and Article 23 reporting obligations.
"high common level of cybersecurity across the Union"
Directive (EU) 2022/2555, Article 20
eur-lex.europa.eu
Referenced sections
  • Sets management-body approval, oversight, liability, and training requirements for essential and important entities.
"approve the cybersecurity risk-management measures"
Directive (EU) 2022/2555, Article 21
eur-lex.europa.eu
Referenced sections
  • Primary legal text for NIS2 cybersecurity risk-management measures and the minimum Article 21(2) measure families.
"appropriate and proportionate technical, operational and organisational measures"
Directive (EU) 2022/2555, Article 23
eur-lex.europa.eu
Referenced sections
  • Sets significant-incident criteria, notification recipients, 24-hour early warning, 72-hour incident notification, intermediate report, final report, and ongoing-incident reporting.
"within 72 hours"
Directive (EU) 2022/2555, Article 3
eur-lex.europa.eu
Referenced sections
  • Defines essential and important entities and minimum information for Member State entity lists.
"Essential and important entities"
Directive (EU) 2022/2555, Articles 3, 20, 21, and 23
eur-lex.europa.eu
Referenced sections
  • Primary source for entity lists, governance, corrective measures, cybersecurity measures, and reporting obligations.
"all necessary, appropriate and proportionate corrective measures"

Related guides

EU NIS2 Directive applicability test for entity scope

Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.

EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks

NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.

NIS2 Annex I and Annex II Sector Scoping Guide

Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.

NIS2 Article 21 control baseline and evidence checklist

Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.

NIS2 Article 21 control-by-control evidence checklist

Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.

NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners

Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.

Show all related guides (34)

NIS2 Article 23 incident notification workflow

Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.

NIS2 Compliance Guide: scope, controls, reporting, and evidence

A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.

NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas

Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.

NIS2 Entity Classifier Workflow: essential vs important entity scoping

Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.

NIS2 entity supervision guide

Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.

NIS2 essential vs important entities: Article 3 scope and supervision guide

Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.

NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties

NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.

NIS2 incident clock triage workflow

Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.

NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps

Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.

NIS2 Management Body Accountability: board duties, training, and evidence

A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.

NIS2 National Transposition Tracker: EU Member State Evidence Register

Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.

NIS2 penalties and fines: Article 34 maximum levels and factors

NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.

NIS2 Registration and Authority Notification Guide

Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.

NIS2 Requirements: scope, Article 21 controls, reporting, and evidence

Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.

NIS2 Size Cap Rule and Special Scope Cases

Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.

NIS2 Supply Chain Security Program: Article 21 Guide

Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.

NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience

Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.

NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance

Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.

NIS2 vs GDPR breach reporting: EU deadlines and overlap

Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.

NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.

NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits

Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.

NIS2 vs NIS1: what changed in EU cybersecurity compliance

Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.

Are managed service providers in scope of NIS2?

NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.

NIS2 24-hour early warning: what to send and when

Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.

NIS2 72-hour incident notification FAQ

NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.

NIS2 entity classification FAQ

Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.

NIS2 Member State Transposition: What Teams Must Check

How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.

NIS2 size-cap rule: when medium and large entities are in scope

Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.