NIS2 compliance checklist: what your business must do before October

The EU’s Network and Information Security Directive 2 — NIS2 — entered into force in January 2023 with a transposition deadline of October 2024. As of mid-2026, every EU member state has transposed the directive into national law. National competent authorities (NCAs) have established their supervisory regimes and are conducting their first structured audit cycles. For the organisations in scope, this is no longer a compliance preparation exercise. It is a live enforcement environment.

NIS2 represents a substantial expansion of scope and teeth compared to the original NIS Directive. The original directive covered seven “operators of essential services” sectors and a narrow set of digital service providers. NIS2 expands to 18 sectors, lowers the size thresholds that trigger coverage, introduces personal liability for management bodies, and raises maximum penalties to a level comparable with GDPR. It also adds explicit requirements around supply chain security, cryptography, and multi-factor authentication that were absent from the original.

This article explains who is in scope, what the 10 minimum security measures actually require, what the incident reporting timeline looks like in practice, and provides a structured checklist that compliance teams can use to assess their current posture against NIS2’s requirements.

Who is in scope: essential vs important entities

NIS2 creates two tiers of covered entities with different supervisory regimes and penalty levels. The distinction matters because essential entities face proactive, ex-ante supervision — meaning authorities can audit them at any time — while important entities face reactive, ex-post supervision triggered by incidents or complaints. Both tiers are subject to the same substantive security requirements under Article 21.

Note that the size thresholds apply at the entity level, not the group level. A subsidiary of a large corporation that itself employs fewer than 50 people and turns over less than €10 million may be out of scope even if its parent group is an essential entity — though NCAs have discretion to extend coverage where smaller entities perform critical functions. Some member states have also exercised their discretion to extend NIS2 obligations to entities below the thresholds where they consider them critical to national infrastructure.

The most important scope question for professional services firms is whether they qualify as digital providers or as part of the supply chain of essential entities. A managed security services provider, a cloud platform used by hospitals, or a software vendor supplying critical infrastructure is almost certainly in scope regardless of size. The supply chain provisions in NIS2 mean that even out-of-scope companies may face contractual NIS2 requirements from their essential-entity customers.

The Article 21 minimum security measures

Article 21 of NIS2 sets out the minimum technical and organisational measures that all covered entities must implement. The measures are not exhaustive — entities must take “appropriate and proportionate” measures based on their risk profile — but these ten areas are the explicit floor that supervisors will check against.

Supply chain obligations: what NIS2 actually requires

Supply chain security under NIS2 (Article 21(2)(d)) is one of the areas where organisations are most often caught under-prepared. The requirement is not simply to have a supplier questionnaire. It requires a structured programme that includes: identification of all direct suppliers and service providers that have access to or influence over your network and information systems; assessment of the cybersecurity practices of those suppliers; and contractual requirements that flow your NIS2 obligations down to critical suppliers.

In practice, this means a covered entity needs to maintain a supplier inventory that includes the supplier’s access level, the criticality of the supplier to service delivery, and an assessment of the supplier’s security posture. For critical suppliers, this should include evidence of the supplier’s own security certifications (ISO 27001, SOC 2 Type II), contractual rights to audit, and incident notification obligations that give the covered entity at least enough notice to meet its own 24-hour early warning deadline.

The supply chain provisions also have an extraterritorial reach implication. If you are a professional services firm supplying an essential entity in Germany, even if you are based outside the EU, your customer’s NIS2 supply chain obligations require them to assess your security posture. Increasingly, NIS2-covered customers are requiring their suppliers to demonstrate NIS2-equivalent security practices as a condition of contract renewal. This creates de facto NIS2 obligations for many out-of-scope firms.

Incident reporting: the three-stage timeline

NIS2 Article 23 creates a three-stage incident reporting obligation that is more demanding than most organisations appreciate until they actually experience a significant incident.

The practical implication is that organisations need to pre-build their incident reporting process before an incident occurs. The 24-hour window is too short to draft a reporting template, identify the correct CSIRT contact, establish an escalation chain, and draft a notification from scratch while simultaneously managing an active incident. Most organisations that have tested this in tabletop exercises find that without prior preparation, they miss the 24-hour window.

Covered entities are also required to notify affected recipients of their services “without undue delay” where the incident is likely to adversely affect them. This is separate from the CSIRT reporting obligation and may need to happen within hours, not days, depending on the nature of the incident. The overlap between NIS2 breach notification and GDPR Article 33/34 notification (where personal data is involved) adds further complexity — the timelines and recipients differ, and both apply simultaneously to incidents affecting personal data on covered systems.

Management body obligations under Article 20

One of the most significant innovations in NIS2 compared to its predecessor is the explicit personal accountability of management bodies. Article 20 requires that management bodies of essential and important entities approve the cybersecurity risk management measures and oversee their implementation. Management body members who breach these obligations can be held personally liable.

This means that NIS2 compliance is not a function that can be delegated entirely to an IT or security team and signed off at arm’s length by the board. Management bodies must receive regular cybersecurity training sufficient to understand the risks their organisation faces and the adequacy of their risk management measures. They must be able to demonstrate engagement with cybersecurity risk at a strategic level, not just sign off on a policy document once a year.

In practical terms, this requires organisations to build cybersecurity reporting into their board-level governance cycle, ensure that board members receive structured cybersecurity awareness training at least annually, and document board oversight of the cybersecurity programme. NCAs conducting supervisory reviews will look for evidence of management body engagement — board minutes, training records, and cybersecurity agenda items are all discoverable.

Practical NIS2 compliance checklist

The following checklist is structured around the Article 21 measures and the key procedural obligations in Articles 20 and 23. It is designed to be used as an internal gap assessment tool, not as a substitute for legal advice on your specific circumstances.

What to do if you are behind

If an assessment against the checklist above reveals significant gaps, the approach that NCAs have indicated they expect is not perfection before October — it is a documented, managed programme with evidence of progress. NCAs have been explicit in guidance from Germany’s BSI, France’s ANSSI, and the Netherlands’ NCSC that they will take a risk-proportionate approach to early enforcement, with organisations that can demonstrate good-faith compliance efforts and a credible remediation timeline receiving more latitude than those with no programme at all.

The minimum credible response to a gap assessment is: a documented risk assessment acknowledging the gaps, a prioritised remediation plan with owners and deadlines, and evidence of management body approval and oversight of that plan. This does not eliminate your compliance obligation, but it demonstrates the good-faith engagement that NIS2’s proportionality principle recognises.

For organisations that are significantly behind, prioritise in this order: MFA (highest impact on breach risk, fastest to deploy), incident reporting process (next incident will expose the gap immediately), supply chain inventory (takes time to build, and auditors check it early), and management body training (required before the first supervisory review). Security policies, risk assessments, and BCP/DRP documentation can follow once the operational controls are in place, but do not wait on documentation — start both tracks simultaneously.