An auditor will not ask whether you “do security”. They will ask to see the risk assessment, the board approval, the last restore test and the supplier register. NIS2 compliance comes down to doing the right things and being able to prove it.
This checklist walks through the ten minimum measures in Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555), the evidence a supervisor is likely to ask for, and the reporting and supply-chain steps that tend to be weakest in practice. Use it for a first gap assessment or to prepare for an inspection.
This is general guidance, not legal advice. Your national transposition law and your authority’s implementing acts take precedence.
Before you start: three scoping questions
| Question | Why it matters | Evidence to keep |
|---|---|---|
| Are you in scope, and as essential or important? | Decides supervision style and maximum fines (Art. 3, 32–34) | Scoping memo mapping your services to Annex I/II and the size test; authority confirmation (in Italy, ACN’s communication of inclusion) |
| Which national rules apply? | Member states add detail, registration steps and deadlines | List of applicable laws and authority determinations for each country you operate in |
| Does Implementing Regulation (EU) 2024/2690 apply to you? | It sets detailed technical requirements for cloud, data centre, managed service, DNS, marketplace and similar providers | Applicability statement; if it applies, a documented justification for any requirement you treat as not applicable |
If you are not sure about scope, start with our NIS2 Directive explained guide.
Governance checklist (Article 20)
Every other measure depends on this one. Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee their implementation and follow training.
| Checklist item | Evidence auditors expect |
|---|---|
| Board has formally approved the security risk-management measures | Board minutes or resolution referencing the approved policy set and risk treatment plan |
| Board oversees implementation | Regular security reporting to the board (KPIs, risk register, incidents, audit findings) and minutes showing discussion and decisions |
| Board members have completed cybersecurity training | Training records per member: date, content, duration, provider |
| Roles are assigned | Named security owner (e.g. CISO), national point of contact, incident decision-makers, with documented responsibilities |
For how to design and record board training, see our upcoming guide to NIS2 management training.
Article 21(2) measures (a)–(j): what to do and what to show
Article 21(1) asks for “appropriate and proportionate” measures. That means you decide the depth based on your risk, size and exposure, but you must record how you decided. The table below covers each of the ten minimum measures.
| Measure | What to implement | Evidence auditors expect |
|---|---|---|
| (a) Risk analysis and information system security policies | A documented risk methodology; an asset-based risk assessment; a top-level security policy and topic policies | Risk assessment report and risk register with owners and treatment decisions; approved and dated policies; review history |
| (b) Incident handling | Incident response policy and procedure covering detection, triage, escalation, containment, recovery and lessons learned | Incident procedure; incident log; severity criteria; post-incident reviews; evidence of monitoring and alerting |
| (c) Business continuity, backup management, disaster recovery, crisis management | Business impact analysis; continuity and DR plans; backup policy with protected (e.g. offline or immutable) copies; crisis management team | BIA with recovery objectives; plans with owners; backup job reports; restore test records; crisis exercise reports |
| (d) Supply chain security | Supplier inventory and risk classification; security requirements in contracts; supplier assessment process | Supplier register with criticality ratings; contract security clauses; completed assessments; follow-up on findings |
| (e) Security in acquisition, development and maintenance, including vulnerability handling and disclosure | Security requirements in procurement; secure development practices; patch and vulnerability management; a way for outsiders to report vulnerabilities | Vulnerability scan results and remediation tracking against SLAs; patch reports; change records; secure coding standard; published vulnerability disclosure policy |
| (f) Policies and procedures to assess effectiveness | A defined set of security metrics; internal audits; management reviews; technical testing | Metrics dashboard; internal audit plan and reports; penetration test reports; corrective action tracker |
| (g) Basic cyber hygiene and cybersecurity training | Hygiene baseline (patching, secure configuration, least privilege, backups); awareness programme for all staff; role-based training | Training plan; completion records; phishing simulation results; hygiene baseline and compliance reports |
| (h) Cryptography and, where appropriate, encryption | Cryptography policy covering approved algorithms, key management, data at rest and in transit | Approved policy; key management procedure; inventory of where encryption is applied; TLS configuration evidence |
| (i) HR security, access control and asset management | Joiner-mover-leaver process; role-based access; privileged access management; asset inventory | Screening and onboarding records; periodic access reviews; privileged account list; leaver de-provisioning records; asset inventory with owners |
| (j) MFA or continuous authentication, secured communications, secured emergency communications | MFA on remote access, privileged and critical systems; secure messaging and conferencing; an out-of-band channel for crises | MFA coverage report; exceptions list with approvals; configuration screenshots; documented emergency communication plan and test |
Practical notes on the measures that slip most often
- (c) Restore testing. Having backups is not the same as being able to restore. Keep a dated record of at least one realistic restore test for critical systems. Our guide to preventing ransomware covers backup design.
- (e) Vulnerability disclosure. Article 21(2)(e) explicitly includes disclosure. A simple published contact point and policy (for example a security.txt file) closes this gap quickly.
- (f) Effectiveness. Policies alone fail this item. You need evidence that you measured something, found issues and fixed them.
- (j) MFA coverage. Auditors look for exceptions. Keep a short, approved list of accounts without MFA and the compensating controls. See what two-factor authentication is for the basics.
- (g) Training. Record completion, not just delivery. Our upcoming security awareness program guide shows how to build a programme that produces usable evidence.
If you already hold ISO/IEC 27001 certification, most of these items map to existing Annex A controls. You still need to check NIS2-specific points such as the reporting timeline, board training and supply-chain depth. See our ISO 27001:2022 implementation roadmap.
Incident reporting readiness (Article 23)
Article 23 requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification. These deadlines leave no time to work out the process during an incident.
| Checklist item | Done? | Evidence |
|---|---|---|
| Criteria for a “significant incident” defined in line with Art. 23(3) and any national or implementing-act thresholds | ☐ | Severity matrix in the incident procedure |
| Named decision-maker (and deputy) authorised to notify the authority | ☐ | Role descriptions; national portal designation (in Italy, the Referente CSIRT) |
| Contact details and portal access for your CSIRT or authority tested | ☐ | Test log; access confirmation |
| Pre-drafted templates for early warning, 72-hour notification and final report | ☐ | Templates stored where the incident team can reach them offline |
| Process to inform service recipients where required | ☐ | Customer communication templates and approval route |
| Link to GDPR breach process where personal data is involved | ☐ | Joint decision flow with the DPO, see our GDPR 72-hour breach notification guide |
| Timestamped incident log that records “time of awareness” | ☐ | Ticketing or log records |
| Reporting rehearsed in an exercise in the last 12 months | ☐ | Exercise report with lessons learned, see our cyber tabletop exercise guide |
Detection capability matters as much as paperwork: you cannot report what you do not see. If you are building monitoring, our guide on setting up a SOC is a good starting point.
Supply-chain security steps (Article 21(2)(d) and 21(3))
Article 21(3) says you must take into account the vulnerabilities specific to each direct supplier and service provider, and the overall quality of their products and cybersecurity practices, including their secure development procedures. In practice, work through these steps:
| Step | Action | Output |
|---|---|---|
| 1. Inventory | List all direct ICT suppliers and service providers, including cloud, MSPs, software vendors and outsourced support | Supplier register |
| 2. Classify | Rate each supplier by access to your systems or data and impact on your essential services | Criticality tier per supplier |
| 3. Assess | Use questionnaires, certifications (e.g. ISO 27001 scope), audit reports or testing, scaled to the tier | Completed assessments with findings |
| 4. Contract | Add security requirements: incident notification to you, vulnerability handling, access controls, audit rights, subcontractor rules, exit support | Updated contract clauses or a security annex |
| 5. Control access | Restrict supplier remote access, enforce MFA and log their sessions | Access configuration and logs |
| 6. Monitor | Reassess critical suppliers periodically and after incidents or major changes | Review schedule and records |
| 7. Plan exit | For critical suppliers, document how you would replace them or bring the service in-house | Exit plan |
Also track the results of EU coordinated risk assessments of critical supply chains under Article 22(1), which Article 21(3) requires you to take into account. If you are a supplier yourself, expect your NIS2 customers to send you the same questionnaires.
Italy: extra items for your checklist
Italian entities follow Legislative Decree 138/2024 and ACN’s determinations. Add these points:
- Annual registration on the ACN portal between 1 January and 28 February, and the information update between 15 April and 31 May.
- Basic security measures under ACN Determination 379907/2025: first-wave entities had 18 months from inclusion in the list, which ACN dates to October 2026. Entities first listed in 2026 have until July 2027.
- Incident notification to CSIRT Italia: in force for first-wave entities since January 2026, and from 1 January 2027 for entities first listed in 2026.
- Board approval: ACN’s FAQs say management bodies must approve the strategic documents, including the training plan, and that this approval cannot be delegated.
- Watch for enhanced measures: in September 2026 ACN opened a consultation on enhanced security measures that will replace the basic ones.
A 90-day plan to close the gaps
| Days | Focus | Key deliverables |
|---|---|---|
| 1–30 | Scope and baseline | Scoping memo, gap assessment against the table above, risk assessment refresh, board briefing |
| 31–60 | Fix the critical gaps | Incident reporting procedure and templates, MFA coverage, supplier register and tiering, backup restore test |
| 61–90 | Prove it works | Tabletop exercise, internal audit of the measures, board approval of the policy set and training records |
AceFortis runs practical NIS2 workshops for IT and compliance teams, covering Article 21 gap reviews, evidence packs and incident reporting drills. Get in touch to plan a session.
FAQ
Is ISO 27001 certification enough for NIS2?
It is a strong foundation, but not automatically enough. NIS2 adds specific requirements such as the 24-hour/72-hour/one-month reporting timeline, management training and liability, and national registration. Map your ISO controls against Article 21(2) and your national rules and close the differences.
How much documentation is “enough”?
Enough to show what you decided, why, who approved it and that it operates. Proportionality applies: a mid-sized manufacturer does not need the same depth as a cloud provider, but both need to justify their choices in writing.
Do we need to assess every supplier?
Article 21(3) refers to each direct supplier and service provider, but you can scale the depth. A tiered approach, with full assessments for critical suppliers and lighter checks for low-risk ones, is the practical way to meet it.
Who should own the NIS2 checklist?
Usually the CISO or security lead, with compliance and legal support. The management body remains accountable and must approve the measures.
