NIS2 readiness checklist

Annex I lists sectors of high criticality such as energy, transport, banking, health and digital infrastructure; Annex II lists other critical sectors such as postal services, manufacturing and digital providers.

As a rule the directive applies to medium-sized and larger entities. Count partner and linked enterprises as the recommendation requires.

Examples include providers of public electronic communications networks or services, trust service providers, TLD name registries and DNS service providers, and sole providers of a critical service in a member state.

The classification decides the supervisory regime and the maximum fines. Large entities in Annex I sectors are generally essential; most other in-scope entities are important.

Member states had to adopt and publish their transposition measures by 17 October 2024 and apply them from 18 October 2024, but several transposed late and status keeps changing, so check the official national measures listed on EUR-Lex for each country. Member states may go beyond the minimum rules, so scope, deadlines and authorities can differ. The national law, not the directive, applies to you directly.

Member states keep a list of essential and important entities. Certain digital providers, including DNS, TLD, domain registration, cloud, data centre, CDN, managed and managed security service providers, online marketplaces, search engines and social networks, submit their details under Art. 27 in the member state of their main establishment (Art. 26) and must report changes within three months.

Record the approval and schedule regular reviews. The management body can be held liable for the entity's infringements of Art. 21.

The training should give enough knowledge to identify risks and assess risk-management practices and their impact on the services provided.

Take into account the state of the art, relevant standards, cost, your exposure to risk, your size and the likelihood and severity of incidents. Cover physical risks as well as cyber threats.

Maintain a documented risk assessment of your network and information systems and an information security policy derived from it.

Define how incidents are detected, analysed, contained and resolved, who is responsible, and how the reporting duties of Art. 23 are triggered.

Keep tested backups, documented recovery procedures with recovery targets, and a crisis organisation that has been exercised.

Assess suppliers' vulnerabilities and security practices and set security requirements in contracts. Art. 21(3) asks you to consider product quality and suppliers' secure development procedures.

Apply secure development practices, patch management and a published way for third parties to report vulnerabilities to you.

Use internal audits, security testing and metrics, and feed the results back into the risk assessment.

Cover topics such as updates, secure configuration, password practice and phishing awareness, and track who has completed training.

Define approved algorithms, key management and where data must be encrypted in transit and at rest.

Keep an asset inventory, grant access on least privilege with regular reviews, and handle joiners, movers and leavers in a controlled way.

Enforce MFA for remote and privileged access, protect voice, video and text channels, and keep an out-of-band channel for use during an incident.

Its Annex sets the technical and methodological requirements for each measure in Art. 21(2)(a) to (j), and Articles 3 to 14 specify when an incident counts as significant for these entities.

An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable material or non-material damage to others.

State whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact.

Update the early warning and give an initial assessment of severity and impact and, where available, indicators of compromise. Trust service providers must notify incidents affecting their trust services within 24 hours.

The final report covers a detailed description, the likely root cause, mitigation measures and any cross-border impact. If the incident is ongoing, send a progress report and the final report within one month of handling it.

For significant cyber threats, tell affected recipients which measures or remedies they can take themselves and, where appropriate, about the threat itself.

Where required, use certified items to demonstrate compliance with parts of Art. 21. Track schemes adopted under Regulation (EU) 2019/881.

Frameworks such as ISO/IEC 27001 can structure your evidence, but certification to them does not by itself prove NIS2 compliance.

Essential entities face proactive supervision including regular and targeted audits; important entities are supervised ex post, typically after evidence or indications of non-compliance.

For infringements of Art. 21 or Art. 23 the maximum must be at least: for essential entities EUR 10 million or 2% of total worldwide annual turnover, for important entities EUR 7 million or 1.4%, whichever is higher. National law may set higher amounts.