Original practical guidance. Review the scope and current requirements with your qualified advisers; these resources do not establish compliance.
Establish applicability first
NIS2 is an EU directive implemented through national law. Confirm the applicable jurisdiction, entity scope and current supervisory guidance with qualified advisers. This original checklist is a discussion aid, not an exhaustive statement of legal requirements. ENISA’s technical guidance for specific digital sectors has a defined scope and should not be assumed to apply identically to every organization.
Governance and ownership
- Which services and entities are in scope, and who approved that assessment?
- Who owns cybersecurity risk decisions and reports them to management?
- Which policies are operating in practice, and when were they last reviewed?
- Is the action plan resourced, with named owners and review dates?
For every answer, record the evidence, its date and the person responsible. Distinguish an unverified statement from a tested control.
Operations and suppliers
- Can the organization demonstrate access reviews, vulnerability handling and secure change practices?
- Which suppliers support critical services, and who reviews their security evidence?
- Are backups protected and restoration tests documented?
- Which service dependencies could prevent recovery, even if your own systems work?
Start with the most business-critical services. Use representative samples to test how procedures work, then expand the review when evidence shows inconsistent execution.
Incident and continuity readiness
- Are incident roles, escalation paths and external contacts current?
- Has the team exercised a realistic incident scenario?
- Who determines whether an incident triggers a reporting obligation?
- Are reporting requirements checked against current national rules?
Avoid relying on a generic reporting timeline without verifying the incident, jurisdiction and applicable obligation.
Turn findings into action
Classify findings as evidenced, partially evidenced, missing or not applicable with justification. Give each gap a risk rationale, owner, due date and completion criterion. Discuss residual risks with the authorized decision-maker. Repeat the review after material changes; a checklist completed once is not continuing assurance.
