NIS2 Compliance Checklist: 20-Point Assessment Guide

This checklist provides a structured approach to assessing your organisation's NIS2 readiness. Each item maps to a specific NIS2 article, allowing you to trace requirements back to the legislative text and prioritise implementation efforts.

The checklist is organised into five domains: Governance, Technical Measures, Incident Reporting, Supply Chain, and Compliance Operations. Work through each domain systematically — governance and risk analysis should be addressed first, as they inform the priorities and proportionality of all subsequent measures.

Your progress is saved locally in your browser. Use this as a living assessment tool: revisit periodically to track progress, identify gaps, and prepare for supervisory reviews. Each item represents a substantive compliance requirement — checking an item should reflect genuine implementation, not just documentation.

For each checklist item, assess whether your organisation has: (1) a documented policy or procedure, (2) implemented technical and organisational controls, (3) evidence of operation and effectiveness, and (4) management body awareness and approval where required.

A checklist item is only complete when all applicable dimensions are addressed. Having a policy without implementation is insufficient. Having implementation without evidence is a supervisory risk. Use the NIS2 proportionality principle — the depth of each measure should be appropriate to your entity's size, risk exposure, and classification (essential vs important).

For organisations starting their NIS2 journey, this checklist serves as a gap analysis tool. For those with mature cybersecurity programmes, it functions as a compliance mapping exercise — identifying where existing controls satisfy NIS2 requirements and where supplementary measures are needed.