NIS2 Compliance Checklist: Who Is in Scope, What to Do

What NIS2 is and why a checklist helps

NIS2 is the EU’s second directive on the security of network and information systems. It replaced the first NIS directive and widens the circle of organisations that must manage cybersecurity risk in a structured way and report serious incidents to the authorities.

Because NIS2 is a directive, it does not apply directly. Each member state writes its own national law, names its own authority and sets its own fines within the EU framework. The core duties are the same everywhere, though, and that is what this checklist follows: who is in scope, the ten measure areas, incident reporting, management accountability and the knock-on effect on suppliers.

Think of the checklist as a map, not a certificate. It helps a manager see what is already in place (backups, passwords, an IT contractor who knows what to do on a bad day) and where the gaps are. The exact legal wording you must meet is in your country’s implementing law.

Who is in scope: the size cap and the exceptions

NIS2 uses two filters. The first is the sector: your organisation must operate in one of the sectors listed in Annex I or Annex II of the directive. The second is size: by default, only medium and large entities are covered. In the directive’s terms that means 50 or more employees, or more than €10 million in annual turnover or balance sheet total, measured with the EU’s standard SME definition.

Annex I covers sectors such as energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration and space. Annex II covers sectors such as postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. The directive calls in-scope organisations “essential” or “important” entities.

Some organisations are in scope regardless of their size. These exceptions matter most for small technical providers:

• You are the sole provider in your member state of a service that is critical for keeping essential social or economic activities running.
• A disruption of your service could have a significant cross-border impact.
• You are a qualified trust service provider, a top-level domain name registry or a DNS service provider.
• You provide public electronic communications networks or services and are above certain size thresholds.
• Your member state has designated you as critical for specific national reasons.

Deadlines and national transposition

Member states had to turn NIS2 into national law by 17 October 2024. Many missed that date. The European Commission sent letters of formal notice in November 2024 and reasoned opinions in May 2025, the usual steps of infringement proceedings.

On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to transpose the directive, seeking a lump sum and daily penalties. Other countries, such as Germany and Poland, adopted their laws later than the EU deadline. The picture changes month by month, so check the current status of the law in each country where you operate.

The ten risk-management measure areas (Art. 21)

Article 21 requires in-scope organisations to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risk. The directive lists ten minimum areas. Proportionate is the key word: a 60-person manufacturer is not expected to run the same programme as a national bank.

Here are the ten areas in plain language, with an example of what each can look like in a mid-sized business:

• Policies on risk analysis and information system security: a written overview of your key systems, the main risks and who owns them.
• Incident handling: a simple procedure for spotting, containing and recovering from an incident, with named people.
• Business continuity and crisis management, including backup management and disaster recovery: tested backups and a plan for running the business while systems are down.
• Supply-chain security: knowing which suppliers and service providers can affect your systems, and what you require from them.
• Security in acquiring, developing and maintaining systems, including handling and disclosing vulnerabilities: patching, secure settings and a way to receive vulnerability reports.
• Policies and procedures to assess whether these measures actually work: periodic reviews, tests or audits.
• Basic cyber hygiene and cybersecurity training: updates, strong passwords, phishing awareness for all staff.
• Policies on cryptography and, where appropriate, encryption: for example encrypted laptops and encrypted connections.
• Human resources security, access control and asset management: an up-to-date list of devices and accounts, and access removed promptly when people leave.
• Multi-factor authentication or continuous authentication, secured voice, video and text communication, and secured emergency communication where appropriate.

Incident reporting: 24 hours, 72 hours, one month (Art. 23)

Article 23 sets a staged reporting process for significant incidents, meaning incidents that cause or could cause serious disruption or losses. Reports go to the authority or the computer security incident response team (CSIRT) named in your national law.

The clock starts when you become aware of the significant incident, not when it is fully understood. That is why the first report is only an early warning.

Management is accountable

NIS2 does not let cybersecurity sit only with the IT contractor. The management body must approve the risk-management measures, oversee how they are implemented and can be held accountable under national law if the organisation fails to comply. Members of management are also expected to take cybersecurity training so they can judge risks themselves.

In practice that means the owner or managing director signs off the security policies, gets a short regular report on risks and incidents, and records decisions. If something goes wrong, a dated record showing what was decided and why is far more useful than a policy nobody read.

National authorities can supervise in-scope organisations and impose fines for breaches. The amounts and procedures are set in national law, so check them in your country’s implementing act.

Not in scope? Your customers may still ask

Supply-chain security is one of the ten measure areas. As a result, in-scope companies commonly send their suppliers security questionnaires and add security clauses to contracts. This happens even when the supplier is a small firm that NIS2 does not cover directly.

For example, a 12-person software agency that maintains a web shop for a food manufacturer may be asked whether it uses multi-factor authentication, how it handles backups and how fast it will report an incident. These are contractual requirements from the customer, not legal duties under NIS2 for the agency, but losing a key customer over an unanswered questionnaire is a real business risk.

Small suppliers can prepare by keeping a short, honest security summary ready: which systems they use, how access is controlled, how backups work and who to contact in an incident.

What to do now

Step 1: Check your sector against Annexes I and II and your size against the cap, then check the exceptions. Write down the result and the reasoning.

Step 2: Find the national law in each country where you operate and note the competent authority, any registration duty and the deadlines that apply to you.

Step 3: Run a gap analysis against the ten measure areas. Start with the measures that reduce the most risk for the least effort: multi-factor authentication, tested backups, access reviews and patching.

Step 4: Write a short incident procedure with the 24-hour, 72-hour and one-month stages, named people and the reporting channel.

Step 5: Present the measures to management for approval, schedule management training and set a date for the first review.

Step 6: List your critical suppliers and decide what you will ask of them. If you are a supplier yourself, prepare your security summary.

Technical measures such as access control, logging, backups and multi-factor authentication have to live inside the systems you actually use. Synelo builds these into the AI assistants, automations and web systems it develops, but it is not a certification body or a law firm.

This is general information as of October 2026, not legal advice; check the details with your lawyer or the competent national authority.