NIS2 compliance checklist and self-assessment
A free, interactive self-assessment based on the NIS2 Directive (EU) 2022/2555. Work through the governance duties, the ten risk-management measures (Article 21) and the reporting timelines (Article 23), and track your progress.
This is a self-assessment based on the directive, not legal advice. NIS2 is implemented in national law, which may add detail and set who is in scope. Check your national transposition and authority.
Official source, checked on 28 Sep 2026:
Governance (Article 20)
- Management approval and accountabilityManagement bodies approve the risk-management measures, oversee implementation, and can be held liable.
- Management trainingManagement (and staff) follow cybersecurity training.
Risk-management measures (Article 21(2))
- Risk analysis and security policiesPolicies on risk analysis and information system security (a).
- Incident handlingDetection, response and recovery for incidents (b).
- Business continuityBackup management, disaster recovery and crisis management (c).
- Supply chain securitySecurity in relationships with direct suppliers and service providers (d).
- Secure acquisition and developmentSecurity in acquiring, developing and maintaining systems, including vulnerability handling and disclosure (e).
- Assessing effectivenessPolicies and procedures to assess whether the measures actually work (f).
- Cyber hygiene and trainingBasic cyber hygiene practices and cybersecurity training (g).
- Cryptography and encryptionPolicies on the use of cryptography and, where appropriate, encryption (h).
- HR security, access control, assetsHuman resources security, access control policies and asset management (i).
- MFA and secure communicationsMulti-factor or continuous authentication, secured voice/video/text and emergency communications (j).
Incident reporting (Article 23)
- Early warning within 24 hoursNotify the CSIRT/competent authority of a significant incident within 24 hours.
- Notification within 72 hoursProvide an incident notification with an initial assessment within 72 hours.
- Final report within one monthSubmit a final report within one month of the notification.
Ready to put NIS2 in place? The NIS2 Toolkit gives you 12 editable Word/Excel documents — the Article 21(2) measures, incident-reporting templates (24h/72h/one month) and an authority overview for FR, ES, NL, BE and PL (€199 one-time).
For supply chain security (Article 21(2)(d)), keep your suppliers in the vendor risk register: free for up to 3 vendors.
Frequently asked questions
What are the NIS2 minimum measures?
Article 21(2) lists ten minimum measures, from risk analysis and incident handling to supply chain security, cryptography, access control and multi-factor authentication. This checklist follows that list.
What are the NIS2 reporting deadlines?
Article 23 sets a three-stage process: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
Does NIS2 apply to my organization?
Scope depends on your sector and size and on national implementation. Check your national NIS2 law and competent authority.
Is my progress stored anywhere?
Only in your own browser. Nothing is uploaded, and you can reset it at any time.
Can I download the checklist for Excel?
Yes. Click “Download for Excel (CSV)” to get every item with your status in a file that opens in Excel, Google Sheets or LibreOffice.
Can I use this NIS2 checklist as a quick check or audit preparation?
Yes. It works as a quick NIS2 check and as preparation for an audit: you see per measure what is in place and what is still open. It is not a formal audit or legal advice.