NIS2 asks companies to do more than buy security tools. Management must approve and oversee the measures, the company must handle incidents within fixed deadlines, and it must be able to prove what it has done. This checklist follows Directive (EU) 2022/2555 in the order we would tackle the work.
Reviewed on 5 November 2026. NIS2 is a directive, so the rules that bind you are in your national law, and details such as deadlines, portals and supervisors differ by country. Use this checklist to organise the work, then confirm each point against your national text with legal counsel.
Step 1: Check whether NIS2 applies to you
As a general rule, NIS2 covers organisations of a type listed in Annex I or Annex II that are at least medium-sized and provide services or carry out activities in the EU.
| List | Sectors |
|---|---|
| Annex I (sectors of high criticality) | Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration, space |
| Annex II (other critical sectors) | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research |
Medium-sized is defined by Recommendation 2003/361/EC. In practice, check whether you have at least 50 employees, or more than EUR 10 million in both annual turnover and balance sheet total. Check at group level too, because linked and partner companies can count towards these figures.
Size does not matter for some organisations, including trust service providers, DNS service providers, top-level domain registries, public electronic communications providers, and any entity that a country designates because it is the sole provider of an essential service or is otherwise critical.
- List every legal entity in your group and every country where it operates.
- Map each service to the sectors and sub-sectors in the Annexes, using their exact wording.
- Record the result and your reasoning, even if you conclude you are out of scope.
Step 2: Identify your category and what it means
Annex I organisations above the medium-sized ceilings are generally essential entities. Other organisations in scope are generally important entities. National designations can change this. The security duties are the same; supervision and maximum fines differ.
| Essential | Important | |
|---|---|---|
| Supervision (Articles 32 and 33) | Proactive, including audits and inspections | After the fact, when there are indications of non-compliance |
| Maximum fine for breaching Article 21 or 23 (Article 34) | At least EUR 10 million or 2% of worldwide annual turnover, whichever is higher | At least EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher |
These are the minimum levels for the maximum fine. Your national law sets the actual ceiling.
Step 3: Register with the authority
Article 3(4) requires you to provide your name, your address and up-to-date contact details (including email addresses, IP ranges and telephone numbers), your sector and sub-sector, and the Member States where you provide services. Changes must be reported within two weeks under the Directive, though some national laws differ.
- Find your national portal and deadline. Several registration deadlines have already passed.
- Name an owner for the registration and a contact who can be reached during an incident.
- Add registration updates to your process for company changes.
Step 4: Put management in charge
Article 20 makes this a board-level duty. Management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. Their members must also follow training, and companies are encouraged to offer similar training to employees regularly.
- Have management formally approve the measures, and keep the minutes.
- Set a regular reporting cycle on risks, incidents and open actions.
- Record who attended which training, when, and what it covered.
Step 5: Run a documented risk analysis
Article 21 requires measures that are appropriate and proportionate, taking into account your exposure, size, the likelihood and severity of incidents, and their societal and economic impact. So start from your own risks rather than a generic list.
- Inventory the services, systems, data and suppliers that matter, including AI systems and agents.
- Assess what could stop those services and what the impact would be.
- Record decisions, owners and dates, including any risks you accept and why.
Step 6: Cover the ten minimum measures
Article 21(2) lists the minimum topics. The right column is our suggestion for the evidence that shows each one works in practice. It is not a list set by the law.
| Article 21(2) | Measure | Useful evidence |
|---|---|---|
| (a) | Risk analysis and information system security policies | Approved policies, risk register |
| (b) | Incident handling | Response plan, on-call rota, incident log |
| (c) | Business continuity, backup management, disaster recovery, crisis management | Restore test results, crisis exercise report |
| (d) | Supply chain security | Supplier register, assessments, contract clauses |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | Secure development process, patch records, disclosure policy |
| (f) | Assessing the effectiveness of the measures | Internal audits, penetration test reports, tracked fixes |
| (g) | Basic cyber hygiene and training | Training records, phishing exercises |
| (h) | Cryptography and, where appropriate, encryption | Crypto policy, key management procedure |
| (i) | Human resources security, access control, asset management | Joiner and leaver process, access reviews, asset inventory |
| (j) | Multi-factor or continuous authentication, secured communications, secured emergency communications, where appropriate | MFA coverage report, fallback communication plan |
Implementing Regulation (EU) 2024/2690 sets more detailed technical requirements for DNS service providers, TLD name registries, cloud, data centre and content delivery network providers, managed service and managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. If you are one of these, work from that regulation.
Step 7: Prepare to report incidents on time
The clock starts when you become aware of a significant incident, meaning one that has caused or could cause severe operational disruption or financial loss, or considerable harm to others (Article 23).
| When | What you send |
|---|---|
| Within 24 hours | Early warning, including whether malicious activity is suspected or there may be a cross-border impact |
| Within 72 hours | Incident notification, with an initial assessment of severity and impact and any indicators of compromise |
| On request | Intermediate report on relevant status updates |
| Within one month of the notification | Final report: description, likely root cause, mitigation, cross-border impact. If the incident is still ongoing, send a progress report, then the final report within one month of finishing the handling |
- Define what counts as significant for your services before an incident happens.
- Prepare templates and decide who can send a report, including at night and at weekends.
- Rehearse the process. GDPR, sector or contractual reporting duties may apply to the same incident.
Step 8: Bring your suppliers into scope
Article 21(3) asks you to consider the vulnerabilities specific to each direct supplier, the quality of their products and security practices, and their secure development procedures. You must also take into account the results of EU coordinated risk assessments of critical supply chains under Article 22(1). Start with the suppliers that could stop your service or reach your data.
- Rank suppliers by criticality, including cloud, software and AI model providers.
- Add security, incident notification and audit clauses to contracts.
- Prepare a fallback for each critical supplier.
Step 9: Test, fix and keep the evidence
Being able to show what you did matters as much as doing it. Keep records in one place, and date them. Test your measures with security assessments and penetration tests, and if you use language models or agents, include LLM security testing. Then track each finding until it is closed.
What is still changing
On 20 January 2026 the European Commission proposed targeted changes to NIS2, including on ICT supply chain security, alongside a revised Cybersecurity Act. Separate Digital Omnibus proposals include a single entry point for incident reporting. These are proposals, not law, so build on the current rules and review your plan as they progress.
Where to go next
For country-specific rules, read our guides to NIS2 in Italy and to the Netherlands and the Nordics. Setexe can help with the gap analysis and the measures: see our NIS2 compliance services or contact us.
This article is general information and not legal advice.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 2, 3, 20, 21, 23, 32, 33, 34 and Annexes I and II
- Clifford Chance, EU cyber reforms proposed (2026)
- Hunton, Implementing Regulation on NIS2 rules for certain digital service providers
