This NIS2 checklist is for small companies that want to know two things: does the directive apply to us, and if it does, what exactly do we have to do? NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Member states had to turn it into national law by 17 October 2024, and many did so late, so the first step of every checklist is to look up your own country's law. What follows is based on the directive text, and it is general guidance, not legal advice.
Step 1: does NIS2 apply to you?
Work through these questions with your national law open next to the directive.
- Do you operate in a listed sector? Annex I lists sectors of high criticality, among them energy, transport, banking, health, drinking water, digital infrastructure, ICT service management for business customers, public administration and space. Annex II lists other critical sectors, such as postal services, waste management, chemicals, food production, manufacturing of certain products, digital providers (marketplaces, search engines, social networks) and research.
- Are you medium-sized or larger? As a rule the directive applies to entities at least the size of a medium enterprise under the EU definition, which means 50 or more staff or more than 10 million euros in annual turnover or balance sheet. A small or micro enterprise is generally outside, with exceptions.
- Are you one of the entities in scope whatever the size? The directive names some, including providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers. Member states may also include small entities that are the only provider of a service in a country or that matter for public safety.
- Are you an essential or an important entity? Large entities in Annex I are essential, others are mostly important. The security duties are the same. The supervision differs: essential entities can be checked proactively, important ones mostly after an incident or evidence.
- Do you supply to someone who is? Article 21 requires entities to manage supply chain risk, so a big customer may put NIS2 style clauses into your contract even if you are not in scope.
If the answer to 1 and 2 (or 3) is yes, continue. If not, you may still use the measures below as a baseline, and write down why you concluded it does not apply.
Step 2: management and governance
- Management approves the cybersecurity risk measures and oversees them (Article 20).
- Members of the management body follow training so they can judge risks, and offer similar training to staff.
- Management can be held liable for infringements under national law, so a signed approval record matters.
- Register with the national authority if your country requires it, and keep the contact details current.
Step 3: the ten measures of Article 21(2)
Article 21 requires appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach. The minimum list has ten items. For each one, write what you do and keep a record.
- Risk analysis and information system security policies. A risk assessment and an IT security policy, reviewed on a date.
- Incident handling. An incident response plan with roles, a contact list and a way to decide what counts as significant.
- Business continuity. Backup management, disaster recovery and crisis management. A data backup policy is a start, but add a restore test with a date.
- Supply chain security. Security aspects of relations with direct suppliers and service providers, covering their vulnerabilities and their own practices. See supplier audits for small companies.
- Security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure. Who patches what, and how fast?
- Assessing the effectiveness of the measures. Internal audits, tests and a review by management. See your first internal audit.
- Basic cyber hygiene and cybersecurity training. A training record per person and date.
- Cryptography and, where appropriate, encryption. A rule for when data is encrypted in transit and at rest.
- Human resources security, access control and asset management. Joiners and leavers, who can reach what, an inventory of devices and systems, and a password policy.
- Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications where appropriate. Switch on a second factor everywhere that offers one, starting with email and admin accounts.
Step 4: incident reporting under Article 23
A significant incident is one that has caused or can cause severe operational disruption or financial loss, or affected others with considerable damage. If you suffer one, three reports follow, to the national CSIRT or the competent authority.
| Report | Deadline | What it contains |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether it is suspected to be caused by unlawful or malicious acts, and whether it could have a cross-border impact |
| Incident notification | Within 72 hours of becoming aware | An update to the early warning, a first assessment of severity and impact, and indicators of compromise where available |
| Final report | Within one month of the notification | A detailed description, the likely cause, mitigation applied and cross-border impact |
If the incident is still going after a month, send a progress report and then the final one within a month of handling it. If it affects service recipients, you may also have to tell them. If personal data is involved, the GDPR has its own 72 hour clock to the data protection authority; see our GDPR checklist.
Practise this before it happens. Decide who can call it significant, who sends the early warning, and keep a post-incident review for what you learned.
A quick self-check for the first month
If you are in scope and have nothing written, do these in order. First, a one page scope note and a management sign-off. Second, switch on a second factor for email, admin and remote access, and confirm backups restore. Third, name an incident lead and a deputy, and put the authority's reporting address and phone number in the plan. Fourth, send your five most important suppliers a short security questionnaire. Fifth, book a half-day tabletop exercise ("our laptop is encrypted by ransomware on a Friday evening") and record what you decided. These five steps cover parts of measures 1, 2, 3, 4, 9 and 10, and they are the first things an authority is likely to ask about.
If you are out of scope
Write one dated paragraph saying which sector, size and national rule you checked and why you concluded NIS2 does not apply, and review it yearly or when you grow, merge or enter a listed sector. Then ask whether a customer in scope has pushed obligations down to you in a contract. Typical clauses ask for a named security contact, notice of incidents within a set time, a right to audit or a completed questionnaire, and use of a second factor. These are contract duties, not NIS2 duties, but they are real and they are the way many small suppliers meet the directive.
Step 5: evidence to keep
- The scope decision (why you are in or out), dated.
- Management's approval of the measures, and training records for management.
- The risk assessment, policies, asset list and supplier list, each with a review date.
- Test records for backup restores and incident drills.
- The incident log, including small events, and any report sent.
- The supplier assessments and signed security terms.
Your national authority sets the supervisory powers: audits, on-site inspections, requests for information and fines. The directive sets maximum fines of at least 10 million euros or 2 percent of worldwide turnover for essential entities, and at least 7 million euros or 1.4 percent for important ones, whichever is higher. National laws apply these.
