What are the NIS2 cybersecurity risk-management measures?

Article 21 lists ten minimum measures: risk-analysis and information-security policies; incident handling; business continuity, backup and crisis management; supply-chain security; security in network acquisition/development/maintenance; effectiveness-assessment policies; cyber-hygiene and training; cryptography and encryption policies; HR security, access control and asset management; and multi-factor authentication or secured communication channels.

When is the NIS2 incident-reporting deadline?

Three stages: an early warning to the CSIRT within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month. Missing the reporting duty is one of the most heavily penalized failures under NIS2.

What are the NIS2 fines?

Essential entities face fines of up to €10 million or 2% of global annual turnover, whichever is higher. Important entities face up to €7 million or 1.4%. Management bodies can also be held personally accountable for supervising compliance.

Updated August 2026 · Applies to essential & important entities

The NIS2 Compliance Checklist for Management Teams

Q: Who must comply with NIS2?

NIS2 applies to essential and important entities in 18 sectors — energy, transport, banking, health, digital infrastructure, public administration, ICT service management, and others — generally organizations with 50+ employees or €10M+ turnover that provide services within the EU. Many small suppliers to these sectors are pulled in indirectly through supply-chain security requirements (Article 21(2)(d)).

24 concrete measures across 6 categories, mapped to Article 21 of Directive (EU) 2022/2555. Tick what's in place, watch your score update live, and get a prioritized gap list at the end. Nothing is stored — everything runs in your browser.

This is a self-assessment tool, not legal advice. It maps to the minimum cybersecurity risk-management measures in NIS2 Article 21 plus the Article 23 reporting duties. Member-state transpositions vary — verify against your national law and involve counsel for formal registration questions.

1. Governance & Risk Management

Art. 21(1)–(2)(a) + Art. 20 — management carries personal accountability.

Entity is classified: you know if you're essential, important, or out of scope MUST Sector + size determines everything else, including registration with your national authority and which fine regime applies. A documented information-security policy exists and management has approved it MUST Art. 21(2)(a) requires risk-analysis and infosec policies. A PDF nobody signed doesn't count. Management body has completed cybersecurity training (Art. 20) MUST NIS2 uniquely holds leadership personally liable. Directors must be able to approve measures they understand. Formal risk assessments run on a schedule, not just once SHOULD Annual at minimum, plus after major changes. Document method (e.g. ISO 27005) and findings. Security budget and responsibilities assigned by name SHOULD Art. 20(1): management must approve measures and oversee implementation — that needs an owner and money.

2. Incident Handling & Reporting

Art. 21(2)(b) + Art. 23 — detect, respond, and report on the clock.

Incident-response procedure documented, with roles and escalation paths MUST Must cover detection, triage, containment, eradication, recovery and lessons learned. 24-hour early-warning channel to your CSIRT is known and tested MUST Significant incidents: warning within 24h, notification within 72h, final report within 1 month. Find your national CSIRT's intake before you need it. Logging and monitoring generate alerts someone actually watches SHOULD You can't meet a 24-hour deadline on incidents you discover weeks later. Centralize logs from critical systems. Incident response has been exercised (tabletop at minimum) SHOULD A plan never rehearsed fails under pressure. Run one tabletop per year and record the findings.

3. Business Continuity & Crisis Management

Art. 21(2)(c) — keep operating, and prove you can recover.

Backups exist for critical systems and are offline/immutable where feasible MUST Ransomware-proof backups are the baseline expectation under Art. 21(2)(c). Backups are restore-tested on a schedule SHOULD An untested backup is a hope, not a control. Record restore tests with dates and outcomes. Business-continuity plan defines RTO/RPO for critical services SHOULD Name the acceptable downtime and data loss per system — regulators increasingly ask for the numbers. Crisis-communication plan includes customers and authorities SHOULD Who says what, when, through which channel — including the CSIRT notification chain.

4. Supply Chain Security

Art. 21(2)(d) — your suppliers' weakness is your liability.

Critical suppliers are listed and assessed for security posture MUST You must identify direct suppliers of network/information systems and evaluate their risks — a simple tiered register satisfies this at first. Contracts include security requirements and incident-notification clauses SHOULD Suppliers must tell you when they're breached, on a deadline. Our compliance template pack includes a vendor clause set. Software you build uses SBOM or dependency tracking SHOULD Art. 21(2)(e) overlaps here: know what's inside anything you ship or buy.

5. Access Control & Asset Management

Art. 21(2)(i) — least privilege, known inventory.

Asset inventory covers hardware, software and data flows MUST You can't protect systems you don't know exist. Include cloud services and SaaS. Multi-factor authentication enforced on remote access and admin accounts MUST Art. 21(2)(j) names MFA explicitly. This is the cheapest high-impact control on the list. Access follows least privilege with periodic reviews SHOULD Quarterly review of who can reach critical systems; revoke leavers immediately. HR security: background checks and secure offboarding defined SHOULD Art. 21(2)(i) covers HR security and access-control policies explicitly.

6. Hygiene, Cryptography & Effectiveness

Art. 21(2)(e)(f)(g)(h) — the remaining named measures.

TLS/HTTPS everywhere; encryption policy for data in transit and at rest MUST Art. 21(2)(h). The free EUComply scanner checks TLS and HSTS on any URL automatically. Cyber-hygiene program: patching cadence and staff awareness training SHOULD Art. 21(2)(g). Critical patches within days, not quarters; phishing simulations at least yearly. Effectiveness of controls is assessed (internal audit or external test) SHOULD Art. 21(2)(f). Penetration test or structured review annually; document remediation. Secure development practices for anything you build or commission SHOULD Art. 21(2)(e): vulnerability disclosure handling and secure-by-default configuration.

Next step: several technical items (TLS, HSTS, headers, resilience signals) can be verified automatically. Run the free scanner on your public URL — it works on any CMS, not just WordPress. Need the documents behind supplier clauses and policies? Browse ComplianceDocs templates.

Frequently asked questions

Who must comply with NIS2?

Essential and important entities across 18 sectors — energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, digital providers and research — generally 50+ employees or €10M+ turnover while providing services in the EU. Suppliers to these entities are pulled in via Article 21(2)(d) contract requirements even when individually below the size threshold.

What exactly does Article 21 require?

Ten minimum measures: risk-analysis and information-security policies; incident handling; business continuity, backup and crisis management; supply-chain security; security in acquisition, development and maintenance; policies to assess effectiveness; basic cyber-hygiene and training; cryptography and encryption policies; HR security, access control and asset management; and multi-factor authentication or secured voice/video/text channels. This checklist maps each one.

How fast do I have to report an incident?

Three deadlines: early warning within 24 hours of awareness, full notification within 72 hours, final report within one month. Only "significant" incidents qualify, but the definition is broad — significant operational disruption or financial/material loss for you, or considerable harm to others. Prepare the process now; don't improvise during an outage.

What happens if we don't comply?

Fines up to €10M or 2% of worldwide turnover for essential entities (€7M / 1.4% for important ones). Supervisors can audit, issue binding instructions, and temporarily suspend certifications or authorizations. Under Article 20, management bodies can be held accountable for failing to oversee compliance.

We're a small supplier to a bigger NIS2 entity — does this apply to us?

Directly, maybe not; contractually, almost certainly yes. Large NIS2 entities must assess and manage their suppliers' security, so expect questionnaires, contract clauses and MFA requirements to flow down to you. Working through this checklist puts you ahead of those requests instead of scrambling when the questionnaire arrives.