NIS 2 compliance checklist: the 10 measures of Article 21, in plain words
A NIS 2 compliance checklist does not need to be invented: the directive already contains one. Article 21(2) of Directive (EU) 2022/2555, published in the Official Journal on 27 December 2022, lists ten cybersecurity risk-management measures that every essential and important entity must have in place "at least". Add the reporting duties of Article 23, the governance duties of Article 20 and the registration data of Article 3(4), and you have the core of what the directive asks of an entity. This article turns them into a checklist with an evidence column, using the directive's wording only.
What the checklist covers and what it does not
NIS 2 is a directive: it sets the obligations, and each Member State's transposition law sets the practical details. The checklist covers the EU layer: scope and classification (Articles 2 and 3), governance (Article 20), the ten measures (Article 21), incident reporting (Article 23) and registration data (Article 3(4)). The competent authority, the registration portal, the reporting form and the fine scale are national matters to check in your country's law.
Step 1: confirm you are in scope
Article 2(1) applies the directive to public or private entities of a type listed in Annex I or Annex II that qualify as medium-sized enterprises under Recommendation 2003/361/EC, or that exceed its ceilings. The European Commission's SME definition page (consulted on 19 October 2026) gives those ceilings: a medium-sized enterprise has fewer than 250 staff and either a turnover of at most EUR 50 million or a balance sheet total of at most EUR 43 million. With fewer than 50 staff and a turnover or balance sheet total of at most EUR 10 million, an enterprise is small and, as a rule, outside the directive.
Annex I lists eleven "sectors of high criticality": energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; space. Annex II lists seven "other critical sectors": postal and courier services; waste management; chemicals; food; manufacturing; digital providers; research. Article 2(2) adds entities regardless of size, such as trust service providers, DNS service providers and central government entities.
Once in scope, Article 3 decides whether you are an essential or an important entity. The measures are the same for both; supervision and fine ceilings differ, as explained in NIS 2: essential vs important entities, what actually changes.
The ten measures of Article 21, one by one
Article 21(1) asks for "appropriate and proportionate technical, operational and organisational measures", judged against the state of the art, the cost of implementation, the entity's exposure to risk, its size, and the likelihood and severity of incidents. Article 21(2) then fixes the minimum content, on an all-hazards basis.
| Article 21(2) | Measure (directive wording, shortened) | Evidence to keep |
|---|---|---|
| (a) | Policies on risk analysis and information system security | Signed security policy, dated risk register, review minutes |
| (b) | Incident handling | Incident procedure, incident register, post-incident reviews |
| (c) | Business continuity, including backup management, disaster recovery and crisis management | Restore test reports, continuity plan, crisis exercise report |
| (d) | Supply chain security, including relationships with direct suppliers and service providers (Article 21(3) asks you to weigh each supplier's vulnerabilities and practices) | Supplier inventory, security clauses, supplier assessments |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | Patch records, hardening standards, vulnerability handling procedure |
| (f) | Policies and procedures to assess the effectiveness of the measures | Audit reports, dashboard, management review minutes |
| (g) | Basic cyber hygiene practices and cybersecurity training | Training records, awareness material |
| (h) | Policies and procedures on the use of cryptography and, where appropriate, encryption | Cryptography policy, inventory of encrypted assets and keys |
| (i) | Human resources security, access control policies and asset management | Asset register, access reviews, HR security clauses |
| (j) | Multi-factor or continuous authentication, secured voice, video and text communications and emergency communications, where appropriate | MFA coverage report, list of approved communication tools |
The digital infrastructure, ICT service management and digital provider services named in Article 21(5) have a more detailed version of each point in Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, which ENISA's "NIS2 Technical Implementation Guidance" of 26 June 2025 explains with examples of evidence. Other entities are not bound by it, but it shows what "appropriate" can mean. Each measure is discussed in NIS 2 Article 21: the risk-management measures explained one by one.
Evidence to keep for each measure
Article 32(2)(g), for essential entities, and Article 33(2)(f), for important entities, let competent authorities request "evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence". Article 21(4) adds that an entity which finds it does not comply must take corrective measures "without undue delay": a dated gap list with owners is itself evidence. Date every document, name an owner, keep one register per measure, and keep proof of doing (restore tests, access reviews, attendance lists, minutes), not only proof of deciding. To score each point first, see NIS 2 gap assessment template: how to score 56 controls in Excel.
Reporting duties to add to the list
An incident is significant under Article 23(3) if it has caused or is capable of causing severe operational disruption or financial loss for the entity, or considerable material or non-material damage to other persons. Article 23(4) requires an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, an intermediate report on request, and a final report not later than one month after the incident notification; if the incident is still ongoing, a progress report at that point and a final report within one month of its handling. Trust service providers send the incident notification within 24 hours. Notifications go to the national CSIRT or, where applicable, the competent authority: the checklist needs a tested contact channel and templates for the three reports.
Two more items belong on the list. Under Article 20, the management body approves the measures, oversees their implementation and can be held liable, and its members must follow training: keep the approval minutes and the training records. Under Article 3(4), the entity submits at least its name, address and contact details (including email addresses, IP ranges and telephone numbers), its sector and subsector, and the Member States where it provides services, and notifies any change within two weeks.
A realistic order of work
- Scope and classify (Articles 2 and 3), and write the reasoning down.
- Appoint one lead, brief the management body on Article 20, submit the registration data of Article 3(4).
- Write the incident procedure and the 24-hour, 72-hour and one-month clock of Article 23: quick to document, and its deadlines run in hours.
- Score the ten measures, list the gaps with an owner and a date (Article 21(4)), and close the riskiest first.
- Have the management body approve the plan and the policy, then review effectiveness on a fixed rhythm (Article 21(2)(f)).
FAQ
Is there an official NIS 2 checklist?
There is no single EU form. The closest thing is Article 21(2) itself, which names the ten measures required "at least". For the services named in Article 21(5), Implementing Regulation (EU) 2024/2690 and ENISA's guidance of 26 June 2025 go further.
Does a small company have to follow this checklist?
As a rule, no. Article 2(1) covers medium-sized and larger entities in the Annex I and II sectors; smaller entities are caught only in the cases of Article 2(2) to 2(4) or if the Member State extends the scope. A small supplier may still receive security requirements from a customer in scope, because Article 21(2)(d) makes supply chain security one of the ten measures.
How often should the checklist be reviewed?
The directive fixes no frequency. It requires procedures to assess effectiveness (Article 21(2)(f)), corrective action without undue delay (Article 21(4)) and updated registration data within two weeks of a change (Article 3(4)); Member States review their lists at least every two years (Article 3(3)). A quarterly review with a fuller annual pass is one workable rhythm; the directive leaves the choice to the entity.