NIS2 Compliance Checklist: 50-Point Guide for Critical Infrastructure [2026]

Policy & Risk Assessment (5 items)

1. Information security policy documented, approved by management, and communicated to all staff
2. Risk assessment methodology defined and applied to all network and information systems
3. Risk treatment plan documented with clear ownership and timelines
4. Risk register maintained and reviewed at least quarterly
5. Residual risks formally accepted by management body

Detection, Response & Reporting (5 items)

6. Incident detection, analysis, and response procedures documented and tested
7. Early warning submitted to CSIRT within 24 hours of becoming aware of significant incident
8. Incident notification submitted within 72 hours with initial assessment
9. Final report submitted within 1 month with root cause analysis and remediation measures
10. Incident response team defined with roles, escalation procedures, and contact details

11. Business continuity plan (BCP) documented for all critical services
12. Disaster recovery plan with defined RTO/RPO for critical systems
13. Backup strategy implemented with regular testing of restore procedures
14. Crisis management procedures defined with communication protocols
15. BCP tested at least annually through tabletop exercises or full simulations

16. Critical suppliers and service providers identified and risk-assessed
17. Security requirements included in all supplier contracts
18. Supplier security posture monitored through audits, certifications, or assessments
19. Incident notification clauses in supplier contracts with defined timelines
20. Supplier concentration risk assessed — alternatives identified for critical suppliers

21. Security requirements defined for all system acquisitions and developments
22. Vulnerability handling procedures for all systems (patching, workarounds, mitigations)
23. Secure development lifecycle (SDLC) implemented for internally developed software
24. Security testing (SAST, DAST, penetration testing) performed before production deployment
25. Change management process includes security review for all significant changes

26. Regular audits of cybersecurity risk management measures (internal or external)
27. Key risk indicators (KRIs) and key performance indicators (KPIs) defined and monitored
28. Penetration testing performed at least annually on critical systems
29. Vulnerability assessments conducted regularly with remediation tracking
30. Audit findings tracked to closure with management accountability

31. Cybersecurity awareness training for all employees (at least annually)
32. Management body receives specific cybersecurity training on risks and governance
33. Phishing simulation exercises conducted regularly
34. Secure configuration baselines defined for all system types
35. Patch management process with defined timelines by severity

36. Encryption policy covers data at rest, in transit, and in use
37. TLS 1.2+ enforced on all external and internal communications
38. Key management procedures documented (generation, storage, rotation, revocation)
39. Cryptographic standards aligned with ENISA/BSI recommendations
40. Certificate management automated with monitoring for expiry

41. Access control policy based on least privilege and need-to-know principles
42. Privileged access management (PAM) implemented with logging and review
43. User access reviews performed at least quarterly for critical systems
44. Joiner/mover/leaver process ensures timely access provisioning and revocation
45. Asset inventory covers all hardware, software, data, and network components

46. MFA enforced for all remote access, privileged access, and critical systems
47. Secured voice, video, and text communications available for sensitive discussions
48. Emergency communication systems tested and available during crises
49. Single sign-on (SSO) implemented where possible to reduce credential sprawl
50. Network segmentation isolates critical systems from general corporate network

• 85-100: Strong compliance posture. Focus on continuous improvement and evidence documentation.
• 65-84: Good foundation with gaps. Prioritise Measures 2 (incident handling) and 4 (supply chain) — these are most scrutinised.
• 45-64: Significant gaps. Create a 6-month remediation roadmap. Consider external support.
• 25-44: Major compliance risk. Board-level attention required immediately.
• 0-24: Critical. Engage compliance specialists. Enforcement risk is high.

NIS2 Article 20: Management bodies of essential and important entities must approve the cybersecurity risk-management measures, oversee their implementation, and can be held personally liable for infringements. They must also undergo cybersecurity training. This isn't optional — it's a legal requirement with personal consequences.