NIS2 Compliance Checklist: Be Ready When the Auditor Calls

NIS2 has moved from transposition into implementation and supervision. Organisations should now be prepared to demonstrate documented risk management, board oversight, tested incident reporting and supply-chain controls when requested by their competent authority.

The October 2024 transposition deadline has passed, but national implementation is not uniform.

On 9 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the European Union over incomplete transposition. In Germany, the NIS2 Implementation Act took effect on 6 December 2025.

Under NIS2 Article 23, incident response must support a 24-hour early warning, a 72-hour incident notification, and a final report within one month.

This checklist helps you prepare the evidence an auditor or competent authority may request.

This isn’t a checklist for getting ready before NIS2 arrives — it’s a checklist for proving you’re ready when the auditor calls.

Who it is for: essential and important entities under NIS2 (energy, transport, banking, health, digital infrastructure, ICT service management, manufacturing and more) and the managed service providers that support them.

What the checklist helps you prepare

• Governance: management body approval and oversight of cybersecurity risk measures, and training for board members.
• Risk management: documented risk analysis and security policies covering the measures in Article 21.
• Incident handling: a tested process that meets the 24-hour, 72-hour and one-month reporting deadlines.
• Business continuity: backups, disaster recovery and crisis management that have been tested, not only written.
• Supply-chain security: an inventory of ICT suppliers and the security requirements in their contracts.
• Technical controls: access control, multi-factor authentication, encryption, vulnerability handling and logging.
• Evidence: the records an auditor or competent authority can request to show the measures work.

How to use it: treat it as an evidence map. For each item, note who owns it and where the proof lives. Our guide on how to prepare for NIS2 explains the obligations, and our NIS2 compliance services cover gap assessments and remediation.

Frequently Asked Questions

Who does NIS2 apply to?

Medium and large organisations in the sectors listed in the directive, plus some smaller entities that national authorities designate as critical.

What are the NIS2 incident reporting deadlines?

An early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.