NIS2 Readiness Checklist: Practical Steps for Businesses

The NIS2 Directive (Directive (EU) 2022/2555) raises cybersecurity expectations for a much wider range of organisations in the European Union than its predecessor. Member states transpose it into national law, so obligations, registration steps, and timelines vary by country. For many mid-sized businesses the practical question is not the legal text but where to start. This NIS2 readiness checklist groups the main expectations into steps you can plan, assign, and evidence. It is general information and not legal advice.

What It Is

NIS2 readiness means understanding whether and how the directive applies to you, then building and documenting the governance, technical, and organisational measures it expects. Article 21 lists the areas of cybersecurity risk-management measures, including risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition and development including vulnerability handling, assessment of the effectiveness of measures, basic cyber hygiene and training, cryptography, human resources security and access control, and multi-factor or continuous authentication. Article 20 places responsibility on management bodies to approve and oversee these measures. Article 23 sets out staged incident reporting to the competent authority or CSIRT: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of the incident notification. National law may add detail, and for certain digital providers, such as cloud, data centre, managed service, and DNS providers, Commission Implementing Regulation (EU) 2024/2690 sets out the technical requirements in more detail.

Who It Is For

This checklist is intended for:

Mid-sized and larger organisations in sectors covered by NIS2 that are assessing their position
Suppliers to covered entities who are receiving NIS2-related security questionnaires
Management teams who need a structured view of what to discuss with legal and technical advisers
IT and security leads preparing a gap analysis and roadmap

What It Helps Clarify

Working through the checklist helps clarify:

Whether your organisation is likely in scope and which national authority applies
Where current controls and documentation fall short of the expected measures
Who in management is accountable and what training they need
Which gaps to address first and which require separate specialist input

What's Included

Scope: confirm sector, size, and the member states where you operate; record the outcome and reasoning
Registration: check whether national law requires you to register with an authority, and by when
Governance: name an accountable executive, agree how management approves and reviews security measures, and plan management training
Risk assessment: document critical services, supporting systems, and the main risks to them
Policies: maintain an information security policy, access control rules, and cryptography guidance
Incident handling: define what a significant incident is for you, who decides, and how the 24-hour, 72-hour, and one-month reports will be prepared
Continuity: test backups and recovery for critical services, and document crisis communication
Supply chain: list key ICT suppliers, review their security commitments, and include security clauses in contracts
Secure development and vulnerability handling: define how vulnerabilities are reported, triaged, and fixed
Hygiene and training: run regular awareness training, patch on schedule, and enforce MFA
Effectiveness: plan periodic reviews or tests to show measures work

What's Not Included

Legal advice or a determination that you are or are not in scope
Certification, compliance approval, or an official audit opinion
Submission of reports or registrations to authorities on your behalf
A claim that completing the checklist satisfies national law

When to Choose It

Use this checklist when you first assess NIS2, when national transposition in a country where you operate is published or updated, or when a customer asks for evidence of NIS2-aligned security. Pair it with legal advice on scope and national requirements. If you already run an ISO 27001-based programme, map existing controls to the checklist before creating new documents. This article is general information and not legal advice.

Our Approach

Start with scope and governance; technical work without management ownership tends to stall. Next, run a gap analysis against the measures, using evidence rather than assumptions: configuration, logs, test results, contracts, and records of training. Rank gaps by risk and effort, and build a roadmap with owners and dates. Our Security Baseline Review can provide a documented starting point: a written view of agreed assets, severity-graded observations, and readiness-gap observations against an agreed reference where included in the confirmed scope. It supports internal decisions and stakeholder discussion with a documented readiness view that you can take to certification bodies and legal advisers. For incident handling, rehearse the reporting timeline with a tabletop exercise so the 24-hour early warning is realistic rather than theoretical. Revisit the roadmap as national guidance develops.

Security Baseline Review

View the Security Baseline Review service page