NIS 2 · Free readiness checklist
NIS 2 Readiness Checklist
Check whether NIS 2 (Directive (EU) 2022/2555 on network and information security) applies to you, whether leadership is on the hook, and whether you can meet the 24-hour, 72-hour and one-month reporting clock.
22 checks in 5 sections. About 15 min. It opens on this page as soon as you send the form. Last reviewed October 23, 2026.
National laws still vary. Most member states have now transposed NIS 2, but not all. In July 2026 the European Commission referred four member states to the Court of Justice for failing to do so, and in January 2026 it proposed targeted amendments that are not yet law. Always check the national law of each country you operate in.
What this checklist covers
- Are you in scope? 4 checks
- Leadership accountability 2 checks
- Risk-management measures (Article 21) 10 checks
- Incident reporting (Article 23) 4 checks
- Fines and watch list 2 checks
Questions
Who is this checklist for?
Medium and large organizations in the sectors NIS 2 covers, and their suppliers, operating in one or more EU member states.
Will this checklist make us compliant or certified?
No. It is a readiness aid that helps you find gaps before you start work with an auditor or assessor. It is general guidance, not legal advice, and it does not know your specific systems.
What happens after I send the form?
The full checklist opens on this page straight away. Your ticks are saved in this browser only, and you can print the checklist or save it as a PDF.
Will you email me?
Only if you tick one of the boxes. We then send one email asking you to confirm your address, and the updates start only after you confirm. You can unsubscribe at any time. Our Privacy Policy explains how we use your details.
This checklist is a general readiness aid, not legal advice. It does not know your specific systems or environment, and completing it does not make an organization compliant or certified. Check obligations that apply to you with qualified counsel.
