A NIS2 compliance checklist should start with your organisation’s scope and national law, then identify the controls and evidence you need. This guide helps an SME organise that assessment; a document management system supports the evidence process but does not establish compliance by itself. Reviewed September 2026.
NIS2 generally covers medium-sized and large entities in specified sectors, with exceptions that can bring smaller organisations into scope. Confirm your sector, entity size, national rules and competent authority. The EU transposition deadline was 17 October 2024; this does not establish that identical national requirements took effect everywhere on the same date. Consult the Commission’s NIS2 overview and your national authority.
Who’s in scope—and what that means day to day
NIS2 broadens coverage to sectors such as energy, transport, health, digital infrastructure and many more. “Essential” status brings stronger supervision, but both essential and important entities must implement proportionate cybersecurity measures and be able to prove those measures work. That proof is not just policies: regulators and auditors want to see the paper trail—the records, approvals, logs and reports that show controls are active, reviewed and effective.
What NIS2 expects: the risk‑management measures, explained
The Commission’s Implementing Regulation (EU) 2024/2690 sets requirements for specified digital entities. ENISA’s technical implementation guidance supports that regulation. Confirm that its scope applies to your organisation before treating it as your mandatory checklist; other sectors must follow their applicable rules.
Below is a plain‑English tour of the measures you’ll actually operate. For each area, keep the records that prove you do what your policy says.
Governance & policy
Management needs to sign off an overarching security policy and topic‑specific policies (risk, incident handling, supply chain, testing, access control and more). The point is accountability: auditors look for evidence that leadership understands cyber risk and drives remediation. Keep: signed policies with version history; board/management minutes showing approvals and reviews.
Risk management
Run a documented risk process: identify assets and threats, assess risks, assign treatments and review after significant changes and at the interval required by your applicable framework. Keep: a current risk register with owners and status, treatment plans and review records.
Incident handling
Have playbooks, roles and a communication plan, and be ready to meet the multi‑stage reporting timeline (see below). Keep: incident tickets and timelines; regulator submissions; post‑incident reviews with actions and owners.
Business continuity & crisis management
Document how you’ll operate through disruption, test your recovery, and record the results. Keep: BCP/DR plans; restore test evidence; improvement actions with sign‑offs.
Supply‑chain security
You’re expected to know your ICT suppliers, assess them, and build security requirements (including exit plans) into contracts. Keep: a supplier register with service descriptions and data types; due‑diligence records; contracts with security clauses; renewal and exit checklists.
Secure change & maintenance
Changes, patches and vulnerabilities should be tracked with approvals and time‑bound treatment. Keep: change tickets; patch windows; vulnerability findings and risk acceptances.
Effectiveness measurement & audit
Don’t just run controls—measure them. Set KPIs/KRIs, run internal audits, and brief management. Keep: dashboards; internal audit reports; management review minutes and action logs.
People, hygiene & training
NIS2 expects basic cyber hygiene and role‑appropriate training. Keep: training plans and attendance; outcomes of phishing exercises or awareness campaigns.
Cryptography, HR, access control, asset & physical security
Define crypto standards and key management; align joiner‑mover‑leaver processes with access reviews; maintain asset and information classification; secure facilities and environmental controls. Keep: key inventories and rotation logs; access review sign‑offs; up‑to‑date asset lists; site access logs and site assessments.
The incident‑reporting timeline (and what to include)
For significant incidents, Article 23 of NIS2 generally requires reporting without undue delay: early warning within 24 hours of awareness, notification within 72 hours of awareness, and a final report within one month of the notification. Ongoing incidents require a progress report and a final report within one month of handling. Trust service providers have a 24-hour notification exception. Confirm national channels and applicable reporting rules with your competent authority.
- Early warning (≤24h after awareness): alert your CSIRT/authority; indicate if it looks malicious/unlawful and whether it could have cross‑border impact.
- Incident notification (generally ≤72h after awareness): update the early warning, give an initial assessment of severity/impact, and include any indicators of compromise.
- Final report (≤1 month after the notification): provide a full description, root cause, mitigation and any cross‑border impacts; submit a progress report if the incident is still ongoing, then the final report within one month of handling it.
Turning requirements into evidence: how a DMS helps you prove it
Policies and processes are necessary, but audits hinge on evidence—who did what, when, and with which approvals. A modern DMS lets you embed that evidence into daily work so it’s captured automatically.
- Audit trails and version history: retain the relevant document versions, workflow records and recorded activity so reviewers can follow changes and decisions. A DMS audit log is not a substitute for security monitoring or a complete incident log.
- Retention and preservation: configure retention automation for the approved schedule. Folderit permits per-file and folder exceptions, including disabling automatic retention. Combine exceptions with permissions and a documented preservation process; a label alone does not enforce a legal hold.
- SSO and access reviews: supported identity-provider connections can centralise sign-in. Configure permissions separately, review access periodically and record the decisions; SSO does not automatically establish least privilege.
- Approvals & acknowledgements: Route policies for approval and send acknowledgement requests to confirm that people have read what they must—a simple way to show governance is working.
- Structured metadata & templates: Standardise registers for risks, incidents and suppliers with required fields for owners, severity, renewal dates, and more. (This is what turns files into reliable “evidence objects”.)
Example evidence workflows to test
- Incident pack: incident ticket → early warning draft → 72‑hour notification → lessons learned → exported audit log of all edits and approvals attached to the record.
- Supplier register: one folder per provider with contract, due diligence, security addendum, exit plan, and renewal reminder metadata; easy to produce on request.
- Policy lifecycle: draft → review → approval → acknowledgement sent to affected teams, with recorded acknowledgement decisions and version history for traceability.
A 30-day evidence setup plan
Week 1 – Scope & leadership:
Confirm whether you’re an essential or important entity using sector/size criteria, brief management on duties, and approve a top‑level security policy.
Week 2 – Evidence foundations:
Create three core registers—risk, incident, and supplier—as DMS templates with mandatory metadata and retention rules. Verify a sample record in each register and agree who will maintain it.
Week 3 – Incident readiness:
Dry‑run the 24h/72h/one‑month flow with a tabletop exercise. Capture drafts and submissions inside the incident record so the audit trail tells the full story.
Week 4 – Access & assurance:
Turn on SSO, run a first access review, and file the sign‑off. Close the month with a management review note that references the new registers, tabletop results and any follow‑up actions.
FAQs
Does NIS2 really apply already?
Check the law and implementation status in your country. The EU transposition deadline and repeal of NIS1 do not by themselves establish your organisation’s current national obligations. The Commission’s January 2026 targeted amendments are described as proposals in its current overview; do not treat a proposal as an enacted change.
How do I know if I’m “essential” or “important”?
Assess sector, size and relevant exceptions under the directive and national law. Document your conclusion and confirm registration or identification requirements with the competent authority; absence from a published list is not a sufficient scope assessment.
What exactly must be in each incident report?
Use Article 23 and your authority’s forms for the required content. Record when the organisation became aware of the significant incident, the applicable deadlines, submissions and acknowledgements. Keep the evidence accessible during an outage; storing a draft in a DMS does not submit it to the authority.
For the product setup, follow our Folderit NIS2 evidence guide. You can start a Folderit trial to test policy approvals, acknowledgements and evidence organisation with sample records. Assign the security and legal work to the appropriate owners; this checklist is not a certification or a complete security programme.
