NIS2 Guide
  1. Home
  2. NIS2 compliance
  3. NIS2 Checklist

NIS2 compliance

NIS2 Checklist: 40 Questions to Check Your Readiness, Mapped to the Articles

NIS2 checklist: 40 readiness questions, each mapped to its Directive article, the Regulation 2024/2690 point and the evidence a supervisor can request.

Last updated 23 October 2026 · By the NIS2 Guide Editorial Team · How we fact-check · Print this page

Summary

This NIS2 checklist asks 40 readiness questions in seven areas, from scope and registration to board approval, the 10 Article 21 measures, incident reporting and the evidence a supervisor can request, and maps each question to its article of Directive (EU) 2022/2555 and, for the 11 entity types of Implementing Regulation (EU) 2024/2690, to the point of that Regulation's Annex.

The questions are answered against national law, which Member States have applied since 18 October 2024 (Article 41(1)), and essential and important entities answer the same 40 questions because both categories carry the same duties. How the law itself is built is explained under NIS2 Directive on the home page.

Answer every question, keep the evidence named in its row, and treat every missing record as a gap to close.

What Is a NIS2 Checklist?

A NIS2 checklist is a list of closed questions that an essential or important entity answers to see whether it meets each obligation of its national NIS2 law, with the article behind every question and the evidence that proves the answer. Each question here is phrased so that the correct answer is "yes, with evidence", because supervisors request records, not statements.

The obligations behind the questions are the same for both categories: Articles 20, 21 and 23 bind essential and important entities alike. The categories differ in supervision (Article 32 against Article 33) and in the maximum fine, so the category changes the answers mainly in area 7. The full set of compliance requirements is set out step by step under NIS2 compliance requirements on the parent page.

A completed checklist records the state of an entity on the date it is answered. It is an internal working document, not a certificate, and its answers change when the entity or its national law changes.

Which Text Each Question Is Checked Against

Each question is answered against the national law that transposes the Directive, because the Directive is addressed to Member States (Article 46) and allows them to go further (Article 5). Article 5 makes NIS2 a minimum-harmonisation act, so a national law can add duties that this checklist does not list.

The Annex column of each table depends on the entity type. Implementing Regulation (EU) 2024/2690 has been in force and directly applicable since 7 November 2024 and binds only the 11 entity types in its Article 1, such as DNS service providers, cloud computing service providers and trust service providers. No implementing act under Article 21(5) exists for other sectors, so every other entity answers against its national list, for example § 30(2) BSIG in Germany. The Annex points cited in the tables come from Implementing Regulation (EU) 2024/2690.

The 40 Questions, Area by Area

The 40 questions fall into seven areas: five on scope and jurisdiction, four on registration and notifications, five on board approval and training, six on risk analysis and policies, eight on incidents and reporting, seven on suppliers, systems and access, and five on evidence for supervision. This requirements checklist follows the order of the law, so Table 0 lists each area with its question numbers and the main articles behind it.

Area Questions Main articles (Directive (EU) 2022/2555)
1 Scope, category, jurisdiction 1 to 5 Art. 2, 3, 26
2 Registration and notifications 6 to 9 Art. 3(4), 27, 29(4)
3 Board approval and training 10 to 14 Art. 20, 21(2)(a)
4 Risk analysis and policies 15 to 20 Art. 21(1), 21(2)(a), (f), (h)
5 Incidents and reporting 21 to 28 Art. 21(2)(b), (c), 23
6 Suppliers, systems, access 29 to 35 Art. 21(2)(d), (e), (g), (i), (j)
7 Evidence for supervision 36 to 40 Art. 21(1), (4), 32, 33

Area 1: Scope, Entity Category and Jurisdiction (Questions 1 to 5)

Area 1 decides whether the other 35 questions apply at all: the entity must be of an Annex I or Annex II type and at least medium-sized, unless a size-independent rule applies (Article 2(1) to (4)). The size test of Recommendation 2003/361/EC counts 50 or more persons, or an annual turnover above EUR 10 million and a balance sheet total above EUR 10 million, with partner enterprises (25 % or more) added pro rata and linked enterprises at 100 %. Jurisdiction follows establishment, while the 11 types of Article 26(1)(b), domain name registration services included, fall under the Member State of their main establishment (Article 26(2)).

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
1 Is the entity of a type listed in Annex I or Annex II? Art. 2(1); Annex I, II n/a Mapping of activities to entity types
2 Is it medium-sized or larger, counting partner and linked enterprises? Art. 2(1); Rec. 2003/361/EC Annex Art. 2, 3, 6(2) n/a Headcount, turnover and balance sheet, including group data
3 Does a size-independent rule apply (trust services, TLD name registry, DNS, central government, CER critical entity, domain name registration)? Art. 2(2) to (4); 3(1)(b), (d), (f) n/a Designation or service record
4 Is the entity essential or important? Art. 3(1), 3(2) n/a Classification note with its legal basis
5 Which Member State has jurisdiction, and has a provider of one of the 11 types of Article 26(1)(b) without an EU establishment designated a representative? Art. 26(1) to (3) n/a Establishment analysis; representative appointment

The related pages are listed below.

Area 2: Registration Data and Notifications (Questions 6 to 9)

Area 2 checks that the competent authority holds current data on the entity: the Article 3(4) items, changes within two weeks, and for the 11 types of Article 26(1)(b) the Article 27(2) data with changes within three months. The Article 3(4) items include up-to-date contact details with email addresses, IP ranges and telephone numbers, the sector and the Member States served. Those types had to submit their Article 27(2) data by 17 January 2025. Entities register nationally, and the single point of contact forwards the Article 27 data to ENISA (Article 27(4)), so no entity registers with ENISA directly. Penalties for failing to register are national (Article 36), not the Article 34 fines.

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
6 Has the competent authority received the Article 3(4) data? Art. 3(4) first subpara. n/a Submission confirmation
7 Is there a process to report changes to that data within two weeks? Art. 3(4) second subpara. n/a Change procedure with a named owner
8 For the 11 types of Article 26(1)(b): has the Article 27(2) data been submitted, with changes reported within three months? Art. 27(2), (3) n/a Submission record
9 Has the authority been told when the entity joined or left a cybersecurity information-sharing arrangement? Art. 29(4) n/a Copy of the notification

The related pages are listed below.

Area 3: Board Approval, Oversight and Training (Questions 10 to 14)

Area 3 checks the board's own duties under Article 20: the management body approves the Article 21 measures, oversees their implementation and its members follow training. The management body can be held liable for infringements (Article 20(1)). Entities are also encouraged to offer similar training to employees on a regular basis (Article 20(2)), and the Directive sets no frequency, duration or exam for either. The strongest measure against an individual, a temporary ban on managerial functions, applies to essential entities only, after other enforcement measures have failed (Article 32(5)(b)).

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
10 Has the management body approved the cybersecurity risk-management measures? Art. 20(1) 1.1.1(k), 1.1.2 Board resolution; policy with its approval date
11 Does the management body oversee implementation and receive the review results? Art. 20(1) 2.3.3 Board minutes and reports
12 Have all members of the management body followed training? Art. 20(2) n/a Attendance records
13 Is similar training offered to employees on a regular basis? Art. 20(2); 21(2)(g) 8.2 Training plan and records
14 Does at least one person report directly to the management bodies on security? Art. 21(2)(a) 1.2.3 Role description and reporting line

The related pages are listed below.

Area 4: Risk Analysis, Policies and Effectiveness (Questions 15 to 20)

Area 4 checks the base of all measures: an all-hazards risk analysis that sizes the technical, operational and organisational measures to the entity's exposure, size, likelihood and severity of incidents (Article 21(1) and (2)). For the 11 entity types of the Regulation, the Annex fixes four intervals: the security policy at least annually (point 1.1.2), the risk assessment and treatment plan at least annually (point 2.1.4), role assignments at least annually (point 10.1.3) and recurring incidents every quarter (point 3.4.2(b)). Independent reviews are carried out by persons outside the line of authority of the area reviewed (point 2.3.2). ENISA's Technical Implementation Guidance, version 1.0 of 26 June 2025, explains each Annex point but is non-binding.

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
15 Are the measures based on an all-hazards risk analysis, proportionate to exposure, size, likelihood and severity? Art. 21(1), 21(2)(a) 2.1 Risk assessment
16 Is the security policy reviewed at least annually? Art. 21(2)(a) 1.1.2 Dated policy versions
17 Are the risk assessment and treatment plan reviewed at least annually, with residual risk accepted by the management bodies? Art. 21(2)(a) 2.1.1, 2.1.4 Treatment plan; risk acceptance record
18 Are there policies and procedures to assess the effectiveness of the measures? Art. 21(2)(f) 7.2, 7.3 Monitoring plan and results
19 Is compliance monitored and independently reviewed by persons outside the line of authority? Art. 21(2)(f) 2.2, 2.3.2 Review reports
20 Are there cryptography policies, with encryption where appropriate? Art. 21(2)(h) 9.1, 9.2 Cryptography policy

The related pages are listed below.

Area 5: Incident Handling, Continuity and the Three Reports (Questions 21 to 28)

Area 5 checks two linked capabilities: handling incidents internally under Article 21(2)(b) and (c), and sending the early warning within 24 hours, the incident notification within 72 hours and the final report one month after the notification under Article 23(4). Only significant incidents must be reported (Article 23(1)). For the Regulation's 11 entity types, a direct financial loss above EUR 500,000 or 5 % of total annual turnover, whichever is lower, is significant (Article 3(1)(a) of the Regulation). Incidents that recur at least twice within six months with the same apparent root cause count together (its Article 4). Reports go to the CSIRT or, where applicable, the competent authority, never to ENISA. Trust service providers send the notification within 24 hours (Article 23(4), second subparagraph).

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
21 Is there an incident handling policy with roles, categorisation and escalation? Art. 21(2)(b) 3.1 Policy and contact lists
22 Can employees, suppliers and customers report suspicious events through a simple mechanism? Art. 21(2)(b) 3.3.1 Reporting channel
23 Are recurring incidents assessed every quarter? Art. 21(2)(b) 3.4.2(b) Quarterly review record
24 Are business continuity, backup, disaster recovery and crisis management in place, with tested recovery? Art. 21(2)(c) 4.1.3, 4.2.6 Business impact analysis; test reports
25 Can the entity decide whether an incident is significant? Art. 23(3)(a), (b) Reg. Art. 3(1)(a), Art. 4 Significance criteria in the procedure
26 Can it send an early warning within 24 hours and an incident notification within 72 hours of becoming aware? Art. 23(4)(a), (b) n/a Reporting procedure; on-call roster
27 Can it send an intermediate report on request and a final report not later than one month after the notification? Art. 23(4)(c), (d) n/a Report templates
28 Does it know its recipient (CSIRT or competent authority) and when to inform the recipients of its services? Art. 23(1) n/a Contact details; communication plan

The related pages are listed below.

Area 6: Suppliers, Systems, People and Access (Questions 29 to 35)

Area 6 checks the measures that reach beyond the IT department: direct suppliers and service providers, acquisition and vulnerability handling, cyber hygiene and training, human resources security, access control, asset management and multi-factor authentication (Article 21(2)(d), (e), (g), (i) and (j)). Suppliers are not directly obliged by NIS2; the entity addresses security in its relationships with its direct suppliers or service providers. The measures apply whether systems are maintained internally or outsourced (recital 83 of the Directive). The Annex sets no day count for patches: they are applied within a reasonable time, and critical vulnerabilities are handled without undue delay. Multi-factor authentication is required where appropriate, in line with the classification of the asset, and never by law for every account.

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
29 Is there a registry of direct suppliers and service providers? Art. 21(2)(d) 5.2 Supplier registry
30 Do supplier selection and contracts address security, taking supplier practices into account? Art. 21(2)(d), 21(3) 5.1.2, 5.1.4 Selection criteria; contract clauses
31 Are patches applied within a reasonable time and critical vulnerabilities handled without undue delay? Art. 21(2)(e) 6.6.1(a), 6.10.2(c) Patch and vulnerability records
32 Are basic cyber hygiene practices and an awareness programme in place, including for the management bodies? Art. 21(2)(g) 8.1 Awareness programme
33 Are role assignments reviewed at least annually and access granted on need-to-know and least privilege? Art. 21(2)(i) 10.1.3, 11.2.2 Access review records
34 Is the register of assets complete, accurate and up to date? Art. 21(2)(i) 12.4 Asset register
35 Is multi-factor or continuous authentication used where appropriate, and is any decision not to use it documented? Art. 21(2)(j) 11.7.1; Reg. Art. 2(2) Authentication standard; documented reasoning

The related pages are listed below.

  • NIS2 supply chain security: questions 29 and 30
  • NIS2 asset management: question 34

Area 7: Evidence for Supervisors and Auditors (Questions 36 to 40)

Area 7 checks whether the entity can prove its answers: a supervisor can request documented cybersecurity policies, the results of security audits by a qualified auditor and the underlying evidence (Article 32(2)(e) and (g), Article 33(2)(f)). Essential entities are supervised ex ante and ex post, with regular, targeted and ad hoc audits (Article 32(2)(b) and (c)); important entities are supervised ex post only, with targeted audits (Article 33(1) and (2)(b)). The audited entity pays for a targeted audit by an independent body, except in duly substantiated cases when the competent authority decides otherwise (Article 32(2) and Article 33(2), third subparagraph each). For infringements of Article 21 or 23, Article 34 sets a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover for essential entities and at least EUR 7,000,000 or 1.4 % for important entities, whichever is higher; national caps differ.

No. Question Legal basis Reg. (EU) 2024/2690 point (its 11 entity types only) Evidence to keep
36 Can the entity show documented cybersecurity policies on request? Art. 32(2)(e) 1.1 Policy set
37 Are the results of audits by a qualified auditor and the underlying evidence available? Art. 32(2)(g); 33(2)(f) 2.3 Audit reports; evidence files
38 Is the entity prepared for the audits that apply to its category, and has it planned to pay for them? Art. 32(2)(b), (c); 33(2)(b); 32(2) and 33(2) third subpara. n/a Audit plan; budget line
39 Is every requirement that the entity does not apply documented with its reasoning? Art. 21(1) Reg. Art. 2(2) Deviation register
40 Is there a process that corrects gaps without undue delay and implements audit recommendations by the set deadline? Art. 21(4); 32(4)(f) n/a Corrective-action log

The related pages are listed below.

How to Score the Answers and Close the Gaps

Score each question yes, partly or no, and count a yes only when the evidence named in the table exists today; every no or partly is a gap that the national law requires the entity to correct without undue delay (Article 21(4)). The Directive sets no fixed number of days for that correction.

Work through area 1 first, because a no on scope makes the other areas moot, then areas 2 and 3, because registration and board approval precede the measures. For the 11 entity types of the Regulation, a "where appropriate" requirement that the entity does not apply counts as a yes only when its reasoning is documented "in a comprehensible manner" (Article 2(2) of Regulation (EU) 2024/2690). A structured NIS2 gap analysis turns the no answers into a plan with owners and dates.

The result goes to the management body, which approves and oversees the measures. No authority approves or lists NIS2 tools, consultants or courses (technology neutrality, Article 25(1)).

The BSI's Seven-Step Checklist as a National Example

Germany's competent authority, the BSI, publishes its own NIS-2-Checkliste (NIS2 checklist) in seven steps: scope check, responsibilities, registration, reporting, management training, the 10 measures and an FAQ. The BSI lists the checklist on its NIS-2 hub as published on 13 March 2026 and provides it as a PDF of the NIS-2-Checkliste. The BSI is also Germany's single point of contact and CSIRT (§§ 40 and 59 BSIG).

Step 2 of the BSI checklist asks for at least two persons for information security coordination. The 40 questions on this page cover the same steps with the EU article and the Annex point behind each one, so a German entity can run both lists side by side. The German law behind the BSI checklist is covered under NIS2 in Germany.

Where the Checklist Stands on 2026-10-23

As of 23 October 2026, no act amending NIS2 has been adopted, so the 40 questions rest on the Directive of 14 December 2022 and on Implementing Regulation (EU) 2024/2690, which has not been amended.

Two proposals are pending. The Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026, and the European Parliament procedure is at "Awaiting committee decision". The Digital Omnibus COM(2025) 837 of 19 November 2025 (2025/0360(COD)) is pending after the Council mandate agreed by Coreper on 21 October 2026. The Commission reviews the functioning of the Directive by 17 October 2027 and every 36 months after that (Article 40).

On 8 July 2026 the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2, with a request for a lump sum and daily penalties (IP/26/1499). What the proposals would change is tracked under NIS2 amendments and review.

What a NIS2 Checklist Does Not Do

A NIS2 checklist does not decide scope for a named organisation, does not replace the national law and does not certify anything: it shows where the entity stands on the date it is answered. Its 40 questions point to the obligations; the national act decides how each one applies.

A checklist, a gap analysis and a supervisory audit answer three different questions. The checklist asks whether each obligation is met. A gap analysis measures each gap against Article 21 or the Annex of Regulation (EU) 2024/2690 and sets a plan to close it. A supervisory audit is ordered by the competent authority and tests the evidence that the checklist only lists.

Is a Completed Checklist Proof of Compliance?

No: a completed checklist is internal evidence, and no EU-wide NIS2 certificate for organisations exists; Article 24(1) only lets Member States require certified ICT products, ICT services and ICT processes. ISO/IEC 27001 is voluntary and creates no legal presumption of conformity under the Directive. The options for proof and certificates are compared under NIS2 certification. A cyber posture certificate is proposed in COM(2026) 13, which is pending as of 23 October 2026.

Is There a Downloadable Version of the Checklist?

The 40 questions are published on this page only; there is no PDF or Excel file to download, and the tables can be copied into any spreadsheet. The BSI publishes its own checklist as a PDF in German. The Directive and Implementing Regulation (EU) 2024/2690 are available as PDF files on EUR-Lex.

Sources