_1762866128417-DS2_OO1j.png)
NIS2 in brief
The NIS2 Directive requires essential and important entities in 18 sectors to manage cybersecurity risks and report significant incidents. It usually applies to medium-sized and large companies (50 or more employees, or more than EUR 10 million turnover and balance sheet) in the sectors listed in Annexes I and II, and to some entities regardless of size.
Member states transpose the directive into national law, often with registration duties towards the national authority. Check the current status of transposition in your country. The reporting deadlines are explained in our guide to NIS2 incident reporting.
NIS2 checklist
Scope and registration
Management (Art. 20)
Risk management measures (Art. 21)
Reporting (Art. 23)
Evidence and improvement
Implementing it with docxpert
docxpert supports the evidence side of NIS2: policy and procedure templates from the template library, training with records for management and employees, and NIS2 incident reporting that calculates the 24-hour, 72-hour and one-month deadlines from detection automatically.
Download the checklist as PDF
Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link.
Frequently asked questions
Does NIS2 apply to small companies?
Usually not. Exceptions exist for certain entities regardless of size, such as providers of public electronic communications networks, qualified trust service providers or DNS service providers. Small companies are often affected indirectly as suppliers.
What fines apply?
For essential entities up to EUR 10 million or 2% of worldwide annual turnover, for important entities up to EUR 7 million or 1.4% – whichever is higher.
Does ISO 27001 certification replace NIS2?
No, but it covers many requirements. You also need to address reporting obligations, registration and the duties of management.