NIS2 has moved from transposition into implementation and supervision. Organisations should now be prepared to demonstrate documented risk management, board oversight, tested incident reporting and supply-chain controls when requested by their competent authority.
The October 2024 transposition deadline has passed, but national implementation is not uniform.
On 9 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union over incomplete transposition. In Germany, the NIS2 Implementation Act took effect on 6 December 2025.
Under NIS2 Article 23, incident response must support a 24-hour early warning, a 72-hour incident notification, and a final report within one month.
This checklist helps you prepare the evidence an auditor or competent authority may request.
This isn’t a checklist for getting ready before NIS2 arrives — it’s a checklist for proving you’re ready when the auditor calls.
Download
