NIS2 Compliance Checklist 2026: Scope, the 10 Article 21 Measures and Incident Reporting

Short answer: NIS2 (Directive (EU) 2022/2555) applies to medium and large organisations in 18 critical sectors, plus some entities regardless of size. To comply you must confirm your scope and classification, register with your national authority, have your management body approve and oversee ten cybersecurity risk-management measures (Article 21), and be able to report significant incidents within 24 hours, 72 hours and one month (Article 23).

Fines reach at least EUR 10 million or 2% of worldwide turnover for essential entities. Senior managers can also be held personally accountable.

The deadline for member states to transpose NIS2 was 17 October 2024. Two years on, enforcement is starting and the Commission has already proposed amendments. This guide gives you the full picture as it stands in October 2026.

🔍 Where NIS2 stands in October 2026

Before the checklist, three facts frame everything that follows.

1. NIS2 is a directive, not a regulation. Your obligations come from your national transposition law, not the EU text directly. Countries may add requirements on top ("gold-plating"), so always read the local law.
2. Transposition is still uneven. On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition, and asked the Court to impose financial penalties.
3. Amendments are proposed, not adopted. On 20 January 2026 the Commission proposed targeted NIS2 amendments alongside a revised Cybersecurity Act. They are still going through Parliament and Council. Until they are adopted and transposed, the current rules apply.

A missing national law does not mean you can wait. Regulators expect organisations to be ready the day the law lands, and many groups operate in member states that have already transposed.

Does NIS2 apply to my company?

Scope is a three-part test. Work through it in order.

Step 1: Are you in a listed sector?

NIS2 covers 18 sectors across two annexes.

Annex I (sectors of high criticality):

• Energy (electricity, district heating and cooling, oil, gas, hydrogen)
• Transport (air, rail, water, road)
• Banking
• Financial market infrastructure
• Health
• Drinking water
• Waste water
• Digital infrastructure (including cloud, data centres, DNS, TLD registries, CDNs, trust services, public electronic communications)
• ICT service management, business-to-business (managed service providers and managed security service providers)
• Public administration
• Space

Annex II (other critical sectors):

• Postal and courier services
• Waste management
• Manufacture, production and distribution of chemicals
• Production, processing and distribution of food
• Manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment)
• Digital providers (online marketplaces, online search engines, social networking platforms)
• Research organisations

Step 2: Do you meet the size threshold?

The general rule is the "size-cap": NIS2 applies to entities that qualify as medium-sized enterprises or larger under the EU SME definition (Recommendation 2003/361/EC).

• Medium: 50 or more employees, or annual turnover and balance sheet both above EUR 10 million.
• Large: 250 or more employees, or annual turnover above EUR 50 million and balance sheet above EUR 43 million.

Some entities are in scope regardless of size, including:

• Providers of public electronic communications networks or services
• Trust service providers
• Top-level domain name registries and DNS service providers
• Sole providers in a member state of a service essential for critical societal or economic activities
• Entities whose disruption could significantly affect public safety, security or health, or create systemic risk
• Certain public administration entities

Group structures matter. Under the SME definition, partner and linked enterprises can count towards your headcount and turnover. Many "small" subsidiaries are pulled into scope this way.

Step 3: Essential or important?

Classification decides how you are supervised and how large the fines can be.

The security obligations are the same for both. The difference is how hard the regulator looks, and the size of the stick.

What about financial entities under DORA?

Article 4 of NIS2 says that where a sector-specific EU law imposes requirements at least equivalent in effect, that law applies instead. For banks, payment institutions, investment firms and other entities covered by DORA (Regulation (EU) 2022/2554), DORA governs ICT risk management and incident reporting.

If you are a financial entity, start with our DORA compliance guide. Your ICT third-party providers, however, may well be NIS2 entities in their own right.

The NIS2 compliance checklist: 10 steps

This is the sequence we use on readiness engagements. Each step produces evidence an auditor or regulator can test.

1. Confirm scope, classification and jurisdiction

• Map every legal entity in your group against the sector annexes.
• Calculate size per entity using the SME rules, including linked and partner enterprises.
• Record your classification (essential or important) and the reasoning.
• Identify which member state has jurisdiction. Most entities fall under the country where they are established, but certain digital providers (DNS, TLD, cloud, data centres, CDNs, MSPs, MSSPs, marketplaces, search engines, social networks) fall under the member state of their main establishment (Article 26).

2. Register with your national authority

• Member states had to establish lists of essential and important entities by 17 April 2025 (Article 3(3)). Entities submit their name, address, contact details, sector, IP ranges where relevant, and the member states where they provide services.
• Certain digital providers listed in Article 27 had to submit additional information by 17 January 2025 for the ENISA registry.
• Update the registration within two weeks of any change (Article 3(4)), or within three months for Article 27 entities (Article 27(3)).

Check your national portal. Registration mechanics and deadlines differ by country, and late-transposing states set their own dates.

3. Put the management body on the hook (Article 20)

NIS2 makes cybersecurity a board responsibility, not an IT one.

• The management body must approve the cybersecurity risk-management measures.
• It must oversee their implementation.
• Members can be held liable for infringements under national law.
• Members must follow training, and entities are encouraged to offer similar training to employees regularly.

For essential entities, authorities can go further. Article 32(5) allows a temporary prohibition on a person discharging managerial responsibilities at CEO or legal representative level, where earlier enforcement action has not worked.

Evidence to keep: board minutes approving the policy set, a training log for each board member, and a regular cyber risk report to the board.

4. Run a risk assessment that drives the controls

Article 21 requires measures that are "appropriate and proportionate" to the risk, using an all-hazards approach. That only holds up if you can show the risk analysis behind your control choices.

• Inventory network and information systems and their dependencies.
• Identify threats, including physical and environmental events, not only cyber attacks.
• Rate likelihood and impact, accounting for your exposure, size and the societal and economic impact of an incident.
• Document risk treatment decisions and owners.

5. Implement the 10 Article 21(2) measures

These are the heart of NIS2. Article 21(2) lists them as the minimum:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security, including security aspects of relationships with direct suppliers and service providers.
5. Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies and procedures on cryptography and, where appropriate, encryption.
9. Human resources security, access control policies and asset management.
10. Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communication systems, where appropriate.

If you already run an ISO/IEC 27001 ISMS, you are not starting from zero. Most of these measures map to Annex A controls.

The gaps we see most often are board-level accountability, supplier-specific risk assessment and the tight incident reporting clock. Our ISO 27001 readiness checklist covers the ISMS foundation.

Digital infrastructure and digital providers: read Implementing Regulation (EU) 2024/2690. For DNS providers, TLD registries, cloud, data centres, CDNs, MSPs, MSSPs, online marketplaces, search engines, social networks and trust service providers, the Commission has set out the technical and methodological requirements in detail. It also defines when an incident is "significant" for those entities, so if you are on that list it is your control catalogue.

6. Secure the supply chain

Article 21(3) requires you to consider the vulnerabilities specific to each direct supplier, the overall quality of their products and cybersecurity practices, and their secure development procedures.

Practical minimum:

• A supplier inventory ranked by criticality.
• Security due diligence before onboarding critical suppliers.
• Contract clauses on security, incident notification and audit rights.
• Periodic reassessment of critical suppliers.
• Account for any coordinated EU risk assessments of critical supply chains (Article 22).

7. Build the incident reporting machine (Article 23)

This is where most organisations fail on day one. A significant incident is one that has caused, or is capable of causing, severe operational disruption or financial loss for the entity, or has affected or can affect other persons by causing considerable material or non-material damage.

When you become aware of a significant incident, you report to your CSIRT or competent authority in stages:

If the incident is still ongoing at the one-month mark, you submit a progress report then, and the final report within one month of handling the incident.

You may also need to notify recipients of your services without undue delay where the incident is likely to adversely affect them. Recipients exposed to a significant cyber threat should be told the measures they can take.

What to build:

• A severity classification matrix with clear "significant" criteria.
• A named decision-maker who can trigger the 24-hour clock out of hours.
• Pre-approved report templates per stage.
• A log that timestamps awareness, decisions and submissions.
• A coordination step with your GDPR breach process, since many incidents trigger both and GDPR's 72-hour clock runs separately. See our GDPR compliance checklist.

8. Prove effectiveness

Measure 6 in Article 21(2) requires you to assess whether your controls actually work. Regulators will ask how you know.

• Define KPIs per control area (patch latency, MFA coverage, backup restore success, phishing test results).
• Run internal audits and periodic penetration tests.
• Track findings to closure with owners and due dates.

9. Prepare for supervision

Essential entities can face on-site inspections, off-site supervision, regular and targeted audits, security scans and information requests (Article 32). Important entities face similar tools after the fact (Article 33).

• Keep an evidence pack per Article 21 measure, mapped to policies, procedures and records.
• Maintain a register of decisions, exceptions and risk acceptances signed off at the right level.
• Rehearse an information request: can you produce your asset inventory, supplier list and last incident report within a day?

10. Watch the national law and the amendment pipeline

• Track your national transposition law and any secondary legislation or authority guidance.
• Monitor the January 2026 amendment proposal. As proposed, it would create a "small mid-cap" category (fewer than 750 employees and under EUR 150 million turnover) generally treated as important entities, add ransomware-specific reporting detail, and allow an EU cyber-posture certificate to reduce duplicate audits.
• Remember that none of this is law yet, and the final text may differ.

Common NIS2 pitfalls

• Assuming you are out of scope because you are "just a supplier". Managed service providers, cloud and data centre providers are directly in scope, and customers will push NIS2 requirements down the chain anyway.
• Ignoring group size rules. Linked enterprises can push a small entity over the threshold.
• Treating it as an IT project. Without board approval, oversight and training records, you fail Article 20 before anyone reviews a firewall rule.
• Copy-paste policies. A policy set downloaded from the internet, with no risk assessment behind it, does not show measures that are "appropriate and proportionate".
• An incident process that cannot hit 24 hours. If your escalation path needs a weekly committee, you will miss the early warning.
• Reading only the directive. National laws differ on registration, reporting portals, additional controls and fines.
• Forgetting DORA overlap. Financial entities need to know where DORA takes over, and their NIS2-regulated suppliers need to know what their customers will demand.

Realistic timeline and effort

These ranges assume a mid-sized organisation with some existing security governance.

• Weeks 1 to 2: Scope, classification, jurisdiction and registration.
• Weeks 2 to 6: Risk assessment and gap analysis against Article 21 (and Implementing Regulation 2024/2690 if it applies).
• Weeks 4 to 8: Board briefing, approval of the policy set, management training.
• Months 2 to 6: Close control gaps, starting with incident reporting, MFA, backups and supplier risk.
• Month 6 onwards: Effectiveness testing, internal audit and continuous improvement.

Organisations with a mature ISO 27001 ISMS can often compress this to three or four months. Organisations starting from scratch should plan for six to twelve months.

Prioritise the incident reporting capability first. It is the obligation most likely to be tested by a real event.

📌 How RegentComply helps

RegentComply turns this checklist into a working compliance project, not a spreadsheet.

• A NIS2 readiness project with the Article 21 measures broken into owned, dated tasks.
• An evidence catalogue that maps every policy, board minute and test result to the requirement it proves.
• Recurring tasks for board reporting, supplier reviews and effectiveness testing, so nothing quietly lapses.
• AI-assisted drafting of policies and procedures that your team then tailors to the real risk picture.

The platform is free to start. AI features are pay-as-you-go.

👉 See a NIS2 readiness project in action: Request a demo

NIS2 FAQ

Does NIS2 apply to small businesses?

Generally no. NIS2 applies to medium-sized and large entities in the listed sectors.

Some entities are in scope regardless of size, such as providers of public electronic communications, trust service providers, TLD registries and DNS providers, and entities a member state designates as critical.

What is the difference between essential and important entities under NIS2?

Both must meet the same Article 21 security measures and Article 23 reporting duties. Essential entities face proactive (ex ante) supervision and maximum fines of at least EUR 10 million or 2% of worldwide turnover.

Important entities face reactive (ex post) supervision and maximum fines of at least EUR 7 million or 1.4%.

What are the NIS2 incident reporting deadlines?

An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, intermediate reports on request, and a final report within one month of the incident notification.

What are the 10 minimum security measures in NIS2?

Article 21(2) lists: risk analysis and security policies; incident handling; business continuity and crisis management; supply chain security; secure acquisition, development and maintenance including vulnerability handling; effectiveness assessment; cyber hygiene and training; cryptography and encryption; HR security, access control and asset management; and multi-factor authentication with secured communications.

Can board members be personally liable under NIS2?

Yes. Article 20 requires management bodies to approve and oversee cybersecurity measures and allows them to be held liable under national law.

For essential entities, authorities can, as a last resort, temporarily prohibit a person from exercising managerial functions.

Is ISO 27001 enough for NIS2 compliance?

It is a strong foundation but not automatically sufficient. ISO 27001 covers most Article 21 controls.

NIS2 adds specific duties such as board training and liability, the 24 and 72 hour reporting clock, registration, and supplier-specific risk assessment. National laws may also add requirements.

Does NIS2 apply to banks and fintechs?

Banking and financial market infrastructure are NIS2 sectors. For entities covered by DORA, however, DORA's ICT risk and incident reporting rules apply as the sector-specific law under Article 4 of NIS2.

Check how your national law handles the overlap.

Has NIS2 been amended?

Not yet. The Commission proposed targeted amendments on 20 January 2026, including a new small mid-cap category and ransomware reporting details.

The proposal must pass the European Parliament and Council and then be transposed before it changes your obligations.

Official sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex
• Commission Implementing Regulation (EU) 2024/2690, EUR-Lex
• European Commission NIS2 policy page

Related RegentComply guides

• DORA compliance: what EU financial firms must do
• ISO 27001 readiness: the 12-step checklist
• GDPR compliance checklist for SaaS

NIS2 rewards organisations that can show their work: a board that approved the measures, a risk assessment behind every control, and a reporting process that can move inside 24 hours. Build that evidence now and the audit becomes a formality.

👉 Request a RegentComply demo