NIS2 compliance scope, controls, and reporting

Do not begin with a generic security checklist. First map each service to an exact Annex I or Annex II entity type. Then calculate SME status using annual work units, financial data, and partner or linked-enterprise aggregation, and check every size-independent Article 2 path.

The compliance record should show the legal entity, service, establishment and Article 26 jurisdiction facts, sector classification, essential or important tier, and the reason any affiliate or product line was excluded. Keep the latest two approved accounting periods because the SME definition normally requires a threshold change over two consecutive periods before status changes. The record should also show whether an equivalent sector-specific Union act displaces only the overlapping NIS2 risk-management or incident-notification provisions.

Article 21 requires essential and important entities to apply appropriate and proportionate cybersecurity risk-management measures. A practical compliance program should convert those measures into named controls, evidence owners, approval checkpoints, and test cadence.

The control baseline should cover risk analysis and information-system security policies, incident handling, business continuity, supply-chain security, secure acquisition and development, vulnerability handling, effectiveness assessment, cyber hygiene, training, cryptography where appropriate, access control, asset management, and secure communications practices.

Management bodies of essential and important entities must approve the Article 21 cybersecurity risk-management measures, oversee implementation, and follow training. The entity's liability consequences depend on the applicable national rules.

Compliance evidence should therefore show when management reviewed the risk posture, what measures were approved, what exceptions were accepted, what training was completed, and how unresolved cyber risk is escalated.

NIS2 significant-incident reporting should be designed before an incident occurs. The workflow needs a detection-to-assessment step, a decision point for significant incidents, and routes to the CSIRT or competent authority required by the relevant Member State.

Article 23 requires an early warning without undue delay and within 24 hours of awareness, an incident notification without undue delay and within 72 hours, requested intermediate reports, and a final report no later than one month after the incident notification. An ongoing incident uses a progress report at that point and a final report within one month after handling. Local law and authority instructions control the submission route.

Common mistakes include treating the EU Directive as a complete local answer, assuming a supplier certificate replaces Article 21 evidence, and failing to connect incident clocks to Member State reporting workflows.

A usable compliance file shows what was decided, what was implemented, what evidence supports it, which source controlled the decision, and when the answer must be revisited.

This checklist helps turn a NIS2 compliance review into an evidence-backed workflow. It is not a substitute for Member State operational guidance, but it helps teams avoid unsupported scope, controls, and reporting decisions.

Store the checklist with the underlying evidence so the next product launch, supplier change, country rollout, or incident review can reuse the decision trail.