> NIS2 checklist: scope, registration, Article 21 risk management measures, Article 23 reporting and management training – free online and as a PDF. Source: [https://docxpert.io/en/checklists/nis2](https://docxpert.io/en/checklists/nis2) # NIS2 Checklist: Check and Implement Your Obligations Save as PDF Print-ready version with tick boxes. [Get the PDF](https://docxpert.io/en/checklists/nis2#download) ## NIS2 in brief The NIS2 Directive requires **essential** and **important entities** in 18 sectors to manage cybersecurity risks and report significant incidents. It usually applies to medium-sized and large companies (50 or more employees, or more than EUR 10 million turnover and balance sheet) in the sectors listed in Annexes I and II, and to some entities regardless of size. Member states transpose the directive into national law, often with registration duties towards the national authority. Check the current status of transposition in your country. The reporting deadlines are explained in our guide to [NIS2 incident reporting](https://docxpert.io/en/guides/nis2-incident-reporting). Management is accountable Under Article 20, management bodies must approve the risk management measures, oversee their implementation and attend training regularly. Infringements can lead to personal liability. ## NIS2 checklist ### Scope and registration - Sector and activities have been checked against Annexes I and II of the directive or the national law. - Company size (employees, turnover, balance sheet) has been assessed including partner and linked enterprises. - Classification as an essential or important entity is documented and justified. - Registration with the competent authority is completed or scheduled. - A person responsible for NIS2 and a contact for authorities are appointed. ### Management (Art. 20) - Management has formally approved the risk management measures. - Management receives regular reports on implementation status. - Members of the management body have attended cybersecurity training; evidence is available. ### Risk management measures (Art. 21) - Policies on risk analysis and information system security are documented. - An incident handling process is defined. - Business continuity: backup management, disaster recovery and crisis management are in place. - Supply chain security, including requirements for service providers, has been assessed. - Security in acquisition, development and maintenance of systems, including vulnerability handling, is defined. - Procedures to assess the effectiveness of the measures are defined. - Basic cyber hygiene and training for all employees take place regularly. - Policies on cryptography and encryption are defined. - Human resources security, access control and asset management are in place. - Multi-factor authentication and secured communications are used where appropriate. ### Reporting (Art. 23) - Internal criteria for when an incident is significant are defined. - The reporting channel to the authority or CSIRT is known and tested. - An early warning within 24 hours of becoming aware is organisationally ensured, including weekends. - An incident notification within 72 hours with an initial assessment is prepared (template available). - A final report within one month is anchored as a process step. - All notifications and deadlines are documented traceably. ### Evidence and improvement - Policies and procedures are controlled, approved and known to employees. - Training records for management and employees are complete. - Every incident is followed by a review with actions. ## Implementing it with docxpert docxpert supports the evidence side of NIS2: policy and procedure templates from the [template library](https://docxpert.io/en/features/template-library), [training with records](https://docxpert.io/en/features/training-certification) for management and employees, and [NIS2 incident reporting](https://docxpert.io/en/features/nis2-incident-reporting) that calculates the 24-hour, 72-hour and one-month deadlines from detection automatically. ## Download the checklist as PDF Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link. ## Frequently asked questions Does NIS2 apply to small companies? Usually not. Exceptions exist for certain entities regardless of size, such as providers of public electronic communications networks, qualified trust service providers or DNS service providers. Small companies are often affected indirectly as suppliers. What fines apply? For essential entities up to EUR 10 million or 2% of worldwide annual turnover, for important entities up to EUR 7 million or 1.4% – whichever is higher. Does ISO 27001 certification replace NIS2? No, but it covers many requirements. You also need to address reporting obligations, registration and the duties of management. ## Read next [NIS2 incident reportingWhen an incident is significant and what to report in 24 hours, 72 hours and one month.Learn more](https://docxpert.io/en/guides/nis2-incident-reporting) [NIS2Implement risk management measures, management training duties and reporting deadlines.Learn more](https://docxpert.io/en/standards/nis2) [NIS2 incident reportingReport security incidents within 24 hours, 72 hours and one month – on time, with evidence.Learn more](https://docxpert.io/en/features/nis2-incident-reporting) [ISO 27001 checklistFrom scope to Statement of Applicability: ready for certification?Learn more](https://docxpert.io/en/checklists/iso-27001-readiness) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)