NIS2 Compliance Requirements Checklist: Every Obligation Your Organization Needs to Address

Reference: NIS2 Directive Articles 2–3, Annexes I and II

• Determine whether your organization qualifies as an "essential" or "important" entity based on sector, size, and criticality thresholds
• Map all subsidiaries and affiliates across EU member states and assess NIS2 applicability for each entity independently
• Identify the competent national authority and single point of contact (SPOC) in each relevant member state
• Register with the relevant CSIRT and/or competent authority as required by national transposition

Reference: NIS2 Directive Article 20

• Ensure management bodies formally approve cybersecurity risk management measures and oversee their implementation
• Establish mandatory cybersecurity training for all members of the management body
• Document the personal liability framework for management body members regarding compliance failures
• Create a board-level reporting cadence for cybersecurity risk posture (quarterly minimum recommended)

Reference: NIS2 Directive Article 21(1)

• Adopt a comprehensive risk analysis and information system security policy covering all network and information systems
• Implement a risk assessment methodology that addresses technical, operational, and organizational risks proportionate to the threat landscape
• Schedule recurring risk assessments,at minimum annually and after any significant change or incident
• Document risk acceptance criteria and escalation procedures for residual risks above threshold

Reference: NIS2 Directive Articles 23, 30

• Establish documented incident detection, classification, and escalation procedures
• Configure systems and processes to deliver an early warning to the competent CSIRT within 24 hours of detecting a significant incident
• Prepare templates and workflows for full incident notification within 72 hours of the early warning
• Define the process for submitting a detailed final report (or progress report) within one month of the incident notification
• Test incident response procedures through tabletop exercises at least annually

Reference: NIS2 Directive Article 21(2)(c)

• Develop and maintain business continuity plans that cover critical network and information systems
• Implement backup management procedures including off-site and immutable backup strategies
• Define disaster recovery objectives (RTO and RPO) for all critical systems and validate them through testing
• Establish crisis management governance including escalation chains, communication plans, and decision authority

Reference: NIS2 Directive Article 21(2)(d)

• Conduct security risk assessments of all direct suppliers and service providers with access to your network, systems, or data
• Include cybersecurity requirements in procurement contracts including incident notification obligations, audit rights, and security standards
• Assess and document the specific vulnerabilities of each direct supplier and the overall quality of their cybersecurity practices
• Monitor supply chain risk on an ongoing basis,not just at onboarding,and establish recertification cadence

Reference: NIS2 Directive Article 21(2)(a), (e)

• Implement security measures for the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure
• Deploy policies and procedures to assess the effectiveness of cybersecurity risk management measures (e.g., penetration testing, security audits)
• Implement network segmentation, intrusion detection, and endpoint protection proportionate to risk

Reference: NIS2 Directive Article 21(2)(h)

• Define and implement policies on the use of cryptography including encryption at rest and in transit for sensitive data
• Establish key management procedures including generation, distribution, storage, rotation, and revocation
• Where appropriate, implement end-to-end encryption or other measures to protect communications confidentiality

Reference: NIS2 Directive Article 21(2)(i), (j)

• Implement human resources security policies including background checks, role-based access, and offboarding procedures
• Deploy multi-factor authentication (MFA) or continuous authentication solutions for all privileged and remote access
• Establish and maintain asset management and access control policies ensuring least-privilege principles
• Implement secured emergency communication systems (voice, messaging, video) with authentication

Reference: NIS2 Directive Article 21(2)(g)

• Implement basic cyber hygiene practices across all staff including password policies, phishing awareness, and secure device usage
• Deliver role-appropriate cybersecurity training at onboarding and on a recurring basis (minimum annually)
• Track training completion rates and assessment scores as auditable evidence
• Ensure management body members complete cybersecurity training as mandated by Article 20(2)

Reference: NIS2 Directive Articles 32–33 (supervision and enforcement)

• Maintain comprehensive documentation of all risk management measures, policies, and procedures in an audit-ready format
• Prepare evidence packages for supervisory authority inspections including risk assessments, incident logs, training records, and supplier assessments
• Establish internal audit or review mechanisms to verify the effectiveness of implemented measures
• For multi-entity groups: implement centralized compliance dashboards providing group-wide visibility while maintaining per-entity documentation
• Track national transposition developments in each member state where you operate and adjust compliance measures accordingly