ChecklistEU

EU NIS2 Directive (EU) 2022/2555 Checklist

A checklist you can assign to owners and verify with evidence.

Use this as a readiness review: each line item should produce an artefact, a control metric, or an operational workflow.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 23, 2026

Updated

Feb 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 23, 2026

Updated Feb 23, 2026

Overview

Compliance checklists fail when they're generic. This one is designed for execution: each step includes what "done" means and what evidence you should be able to produce under supervision.

Section 1

1) Scope and classification (the output is a defensible scope memo)

Start by scoping per legal entity and per service. Without a scope memo, downstream controls and reporting workflows are misaligned.

Map your sector/subsector to Annex I or Annex II; document any borderline cases.
Apply size-cap rules and any regardless-of-size triggers; keep an SME classification note where relevant.
Classify as essential or important (Article 3) and record the rationale and jurisdiction assumptions.
Identify sector-specific EU acts that may apply (Article 4) and document equivalence decisions.
Done looks like: a scope memo with entity list, sector mapping, size logic, classification, and national transposition assumptions.

Section 2

2) Article 20 governance (management approval, oversight, and training)

NIS2 explicitly pulls cybersecurity into the management body. Treat this as a governance system, not a policy signature.

Management body approves the cybersecurity risk management measures and oversees implementation.
Management body training: define curriculum, cadence, attendance tracking, and update loop after incidents.
Define a governance cadence: monthly metrics, quarterly risk reviews, annual crisis exercises.
Done looks like: board/management minutes, training evidence, and an accountability/RACI model.

Section 3

3) Article 21 control baseline (owned controls with KPIs and evidence)

Build a control register that maps Article 21(2) a-j to concrete controls with owners, metrics, and evidence.

Risk analysis + policies: risk method, asset/service inventory, treatment plans, risk acceptance decisions.
Incident handling: runbooks, escalation paths, forensic readiness, post-incident review cadence.
BC/DR: backup strategy, restore tests, DR exercises, crisis management playbooks.
Supply chain: vendor tiering, security clauses, onboarding/offboarding, supplier incident comms.
Secure development + vulnerability handling: secure SDLC, patching SLAs, disclosure process.
Effectiveness: audits, scans, control tests, corrective action tracking.
Done looks like: a control register + evidence vault (links to policies, logs, tests, audits, and training).

Section 4

4) Article 23 incident reporting (a workflow you can execute at 02:00)

Implement reporting as a pipeline with triggers, templates, and evidence capture so you can meet 24h/72h deadlines under uncertainty.

Define "significant incident" triage thresholds and keep a decision log (who decided, when, and why).
24h early warning; 72h notification with initial assessment and IoCs; final report within 1 month.
Recipient communications playbook for incidents likely to adversely affect service provision.
Done looks like: templates, runbooks, authority contact paths, evidence capture process, and a tabletop exercise result.

Recommended next step

Turn EU NIS2 Directive (EU) 2022/2555 Checklist into an operational assessment

Assessment Autopilot can take EU NIS2 Directive (EU) 2022/2555 Checklist from turning this checklist into an operational workflow to a reusable workflow inside Sorena. Teams working on EU NIS2 Directive (EU) 2022/2555 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Assessment workflow

Open Assessment Autopilot for EU NIS2 Directive (EU) 2022/2555 Checklist

Start from EU NIS2 Directive (EU) 2022/2555 Checklist and turn the guidance into owned tasks, evidence requests, and review checkpoints.

Explore next step

Talk to Sorena

Talk through EU NIS2 Directive (EU) 2022/2555

Review your current process, evidence gaps, and next steps for EU NIS2 Directive (EU) 2022/2555 Checklist.

Explore next step

Primary sources