# NIS2 compliance checklist and self-assessment > Free NIS2 self-assessment tool: check how NIS2 compliant you are against the Article 21 measures and Article 23 reporting duties. Saved in your browser. URL: https://gofirmhub.com/en/compliance/nis2/checklist/ Last updated: 2026-10-30 A free, interactive self-assessment based on the NIS2 Directive (EU) 2022/2555. Work through the governance duties, the ten risk-management measures (Article 21) and the reporting timelines (Article 23), and track your progress. This is a self-assessment based on the directive, not legal advice. NIS2 is implemented in national law, which may add detail and set who is in scope. Check your national transposition and authority. Official source, checked on 28 Sep 2026: - [Directive (EU) 2022/2555 (NIS2) — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) Progress0% ### Governance (Article 20) - Management approval and accountabilityManagement bodies approve the risk-management measures, oversee implementation, and can be held liable. - Management trainingManagement (and staff) follow cybersecurity training. ### Risk-management measures (Article 21(2)) - Risk analysis and security policiesPolicies on risk analysis and information system security (a). - Incident handlingDetection, response and recovery for incidents (b). - Business continuityBackup management, disaster recovery and crisis management (c). - Supply chain securitySecurity in relationships with direct suppliers and service providers (d). - Secure acquisition and developmentSecurity in acquiring, developing and maintaining systems, including vulnerability handling and disclosure (e). - Assessing effectivenessPolicies and procedures to assess whether the measures actually work (f). - Cyber hygiene and trainingBasic cyber hygiene practices and cybersecurity training (g). - Cryptography and encryptionPolicies on the use of cryptography and, where appropriate, encryption (h). - HR security, access control, assetsHuman resources security, access control policies and asset management (i). - MFA and secure communicationsMulti-factor or continuous authentication, secured voice/video/text and emergency communications (j). ### Incident reporting (Article 23) - Early warning within 24 hoursNotify the CSIRT/competent authority of a significant incident within 24 hours. - Notification within 72 hoursProvide an incident notification with an initial assessment within 72 hours. - Final report within one monthSubmit a final report within one month of the notification. Ready to put NIS2 in place? The [NIS2 Toolkit](https://gofirmhub.com/en/compliance/nis2-toolkit/) gives you 12 editable Word/Excel documents — the Article 21(2) measures, incident-reporting templates (24h/72h/one month) and an authority overview for FR, ES, NL, BE and PL (€199 one-time). For supply chain security (Article 21(2)(d)), keep your suppliers in the [vendor risk register](https://gofirmhub.com/en/compliance/vendor-risk-register/): free for up to 3 vendors. ## Frequently asked questions ### What are the NIS2 minimum measures? Article 21(2) lists ten minimum measures, from risk analysis and incident handling to supply chain security, cryptography, access control and multi-factor authentication. This checklist follows that list. ### What are the NIS2 reporting deadlines? Article 23 sets a three-stage process: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. ### Does NIS2 apply to my organization? Scope depends on your sector and size and on national implementation. Check your national NIS2 law and competent authority. ### Is my progress stored anywhere? Only in your own browser. Nothing is uploaded, and you can reset it at any time. ### Can I download the checklist for Excel? Yes. Click “Download for Excel (CSV)” to get every item with your status in a file that opens in Excel, Google Sheets or LibreOffice. ### Can I use this NIS2 checklist as a quick check or audit preparation? Yes. It works as a quick NIS2 check and as preparation for an audit: you see per measure what is in place and what is still open. It is not a formal audit or legal advice. ## Related free tools - [ISO 27001 Checklist 2022: Requirements & Controls](https://gofirmhub.com/en/compliance/iso-27001/checklist/): Free ISO 27001:2022 requirements checklist and audit template. Track clauses 4–10 and Annex A control themes… - [ISO 27001:2022 Toolkit — 40 editable documents](https://gofirmhub.com/en/compliance/iso-27001-toolkit/): Editable ISO 27001:2022 starter pack: 40 Word/Excel documents, incl. 5 forms and a risk register. The SoA… - [NIS2 Toolkit — 12 editable compliance documents](https://gofirmhub.com/en/compliance/nis2-toolkit/): Editable NIS2 starter pack: 12 Word/Excel docs for governance, measures & incident reporting. Includes… - [Free Cookie & Tracker Scanner](https://gofirmhub.com/en/compliance/cookie-scanner/): Scan any website for cookies and third-party trackers. Free cookie scanner showing first- vs third-party… - [Free Privacy Policy Generator](https://gofirmhub.com/en/legal/privacy-policy-generator/): Generate a free privacy policy for your website in minutes. GDPR-aware template you fill in yourself, in your… - [Free Terms and Conditions Generator](https://gofirmhub.com/en/legal/terms-and-conditions-generator/): Generate free terms and conditions for your website in minutes. A template you fill in yourself, in your… - [Vendor Risk Register & Assessment Tool (NIS2)](https://gofirmhub.com/en/compliance/vendor-risk-register/): A vendor risk register in your browser: supplier list, security questionnaire, risk score, review dates and… - [E-Invoicing Standard EN 16931 & Peppol Guide](https://gofirmhub.com/en/invoice/e-invoicing/): What is an e-invoice? A clear guide to the EN 16931 e-invoicing standard, Peppol e-invoicing and EU deadlines…