NIS2 Compliance Checklist (Download Outline)

1. Scope & Governance

• Sector / Annex classification documented (essential vs important)
• Member State registration / notification complete where required
• Management-body approval of risk-management measures (Art 20)
• Board / management training records retained

2. Article 21 — All 10 Categories

• Risk analysis & IS security policies
• Incident handling playbooks tested
• Business continuity / backup / DR / crisis management
• Supply chain security (direct suppliers & MSPs)
• Secure acquisition, development, maintenance & vulnerability handling
• Effectiveness assessment of measures
• Cyber hygiene & staff training
• Cryptography / encryption policies
• HR security, access control, asset management
• MFA / continuous authentication & secured communications where appropriate

3. Article 23 Reporting Readiness

• 24-hour early warning path rehearsed
• 72-hour notification package template ready
• One-month final report owners assigned
• CSIRT / authority contacts current

4. Evidence Hygiene

• Central evidence store with control owners
• Logging/monitoring coverage for critical systems
• Supplier assessment register

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is there an official EU checklist PDF?

Authorities publish national guidance. This CyberSilo outline maps Directive themes for programme planning.

Should essential and important entities use different checklists?

Core Article 21/23 items are shared; add national supervisory and registration extras for essential entities.

Can we download an Excel from this page?

Treat the sections above as the download outline; ask CyberSilo for a working sheet during a readiness engagement.

Related NIS2 Resources

NIS2 hub · Gap assessment · CSA