[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [NIS2 Compliance Checklist (Free)](/blog/nis2-compliance-checklist) Publish date December 2, 2025 {x} minute read # NIS2 Compliance Checklist (Free) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/nis2-compliance-checklist) [Free trial](/demo) Written by [Leah Sadoian](/team/leah-sadoian) Content Writer Leah is an experienced cybersecurity writer. Her work is read by leaders in security, tech, education, healthcare, and government. Reviewed by [Cindy Ruan](/team/cindy-ruan) Lead GRC specialist Cindy combines degrees in Computer Science and Law with expertise in GRC, and she has presented her insights at the Australian Cyber Conference. Table of contents Checklist NIS2 Compliance Checklist Free resource ### NIS2 Compliance Checklist [Download now](/resources/nis2-compliance-checklist) In January 2023,[ the European Commission (EC)](https://commission.europa.eu/index_en) released an updated version of the European Union (EU)[ Network and Information Security Directive (NIS2)](https://eur-lex.europa.eu/eli/dir/2022/2555) to strengthen[ cybersecurity risk management](https://www.upguard.com/blog/cybersecurity-risk-management) across Europe’s essential services. NIS2 updates the original[ NIS directive](https://www.upguard.com/blog/nis-directive) and focuses more on regulations for cloud infrastructure, internet exchanges, domain service providers, and digital service providers. Organizations that offer goods or services in any EU Member State must comply with NIS2 by October 17, 2024. This blog briefly covers NIS2 and includes a free NIS2 compliance checklist that organizations can use to audit their[ cybersecurity](https://www.upguard.com/blog/cyber-security) practices and identify areas for improvement. [Enhance your organization’s cybersecurity and vendor management with UpGuard >](https://www.upguard.com/) ## What is NIS2? [NIS2](https://www.upguard.com/blog/what-is-nis2) is an updated version of the original NIS Directive (NIS1), introduced by the EC in July 2016. It aims to enhance the overall cybersecurity measures of organizations across EU Member States. The NIS2 Directive builds on the foundation of the original directive and expands its scope to cover additional sectors and organizations while also addressing emerging[ cyber-attacks](https://www.upguard.com/blog/cyber-attack). NIS2 provides a comprehensive framework that organizations must follow to improve their[ cybersecurity](https://www.upguard.com/blog/cyber-security) and[ cyber resilience](https://www.upguard.com/blog/cyber-resilience), safeguard critical information systems and[ personal data](https://www.upguard.com/blog/personally-identifiable-information-pii), and tackle emerging[ cyber threats](https://www.upguard.com/blog/cyber-threat). ### Key differences between NIS2 and NIS The NIS2 Directive comprises several core components published in the original NIS Directive. Together, these components enhance[ cybersecurity](https://www.upguard.com/blog/cyber-security) practices, encourage EU organizations to develop comprehensive[ cybersecurity programs](https://www.upguard.com/blog/cybersecurity-fields), and ensure holistic compliance. There are distinct updates in NIS2, which include: * **Scope of application:** Expanded to include medium and large essential entities in critical sectors, including postal and courier services, waste management, and manufacturers of critical products. * **Security requirements:** Introduced stricter and more detailed security and[ access control](https://www.upguard.com/blog/access-control) measures, including[ encryption](https://www.upguard.com/blog/encryption) and[ multi-factor authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) (MFA) * **Incident management: **Incident handling procedures were updated to require immediate preliminary notification of security incidents within 24 hours and detailed notification within 72 hours * **National frameworks:** Updated requirements with enhanced powers for national authorities and mandates for stricter national supervision * **Fines and penalties:** Introduced specific penalties up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher * **Regulatory authority:** Significantly increased powers, including direct enforcement powers and the ability to conduct[ audits](https://www.upguard.com/blog/difference-between-compliance-and-auditing-in-information-security) and impose fines * **Risk management:** Broadened[ risk management](https://www.upguard.com/blog/cybersecurity-risk-management), addressing[ supply chain security](https://www.upguard.com/blog/biggest-supply-chain-security-risks) and[ third-party service](https://www.upguard.com/blog/third-party-vendor) continuity and integrity * **Sector-specific measures:** Expanded sectors and include additional requirements tailored to sector-specific risks ## Who must comply with NIS2? [NIS1](https://www.upguard.com/blog/nis-directive) applied to eight sectors in the European Union:[ healthcare](https://www.upguard.com/blog/biggest-data-breaches-in-healthcare), energy, transport, drinking water,[ banking](https://www.upguard.com/blog/biggest-data-breaches-financial-services), digital infrastructure, and digital service providers. NIS2 now includes new classification rules and expands the scope to cover additional important entities, including: * Public administration * Wastewater * Space * ICT service management * Research * Food production * Postal services * Waste management * Manufacturing * Chemicals production ### How to prepare for NIS2 compliance Organizations preparing for NIS2 compliance can now take various steps to make the[ compliance process](https://www.upguard.com/blog/what-is-compliance-management) seamless. This preparation includes identifying any compliance gaps to reassess organizational compliance. Organizations can also create[ a culture of risk awareness](https://www.upguard.com/blog/developing-a-culture-of-cybersecurity) while educating stakeholders and employees on compliance requirements in their specific departments. Leveraging a[ cybersecurity solution](https://www.upguard.com/blog/best-attack-surface-management-software-solutions) like[ UpGuard](https://www.upguard.com/) can also help organizations reach NIS2 compliance. A comprehensive cybersecurity solution can help with everything from[ vulnerability](https://www.upguard.com/blog/vulnerability) detection to[ incident reporting](https://www.upguard.com/blog/cyber-incident-reporting) and beyond, all aimed at reducing[ cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk) and meeting compliance requirements. ## NIS2 Compliance Checklist Compliance checklists are an excellent way for organizations to start auditing and evaluating their current[ compliance management](https://www.upguard.com/blog/what-is-compliance-management) program and identify areas for improvement. Below is a free NIS2 compliance checklist that covers updated areas in the Directive, which your organization can customize to fit its unique needs. Be sure to reference the[ full NIS2 Directive](https://eur-lex.europa.eu/eli/dir/2022/2555) alongside this checklist to ensure your organization complies with the updated components. ### Governance and Risk Management * Define organizational goals and[ risk appetite](https://www.upguard.com/blog/risk-appetite-calculation-third-party-risk-management), assuring that any NIS2 compliance framework supports strategic objectives and acceptable risk levels. * Assign clear roles and responsibilities for NIS2 compliance tasks, identifying who is liable in case of non-compliance. * Identify and document[ cyber risks](https://www.upguard.com/blog/cybersecurity-risk) in your environment, focusing on internal and external factors that could impact security. * Regularly review[ cybersecurity](https://www.upguard.com/blog/cyber-security) measures and ensure management involvement in the approval and oversight process. ### Cybersecurity Policies and Procedures * Ensure[ security policies](https://www.upguard.com/blog/information-security-policy) are documented, clearly understood, and assessed periodically. * Implement formal[ incident response plans](https://www.upguard.com/blog/incident-response-plan) and handling, including a detailed ticketing system for incident detection, triage, and response to meet reporting obligations. * Secure[ supply chain](https://www.upguard.com/blog/how-to-prevent-supply-chain-attacks) interactions and mitigate risks related to suppliers or[ service providers](https://www.upguard.com/blog/evaluating-managing-service-provider-security-risks), ensuring comprehensive security from end to end. * Establish backup management and disaster recovery plans that align with agreed Recovery Time Objectives (RTOs) to ensure[ business continuity](https://www.upguard.com/blog/business-continuity-plan). ### Technical and Operational Measures * Assess and implement basic[ cyber hygiene](https://www.upguard.com/blog/cyber-hygiene) practices and conduct regular[ cybersecurity training](https://www.upguard.com/blog/developing-a-culture-of-cybersecurity) to maintain high-security standards. * Secure your network and[ information systems](https://www.upguard.com/blog/isms), focusing on robust[ vulnerability](https://www.upguard.com/blog/vulnerability) handling and disclosure practices. * Use strong[ cryptography](https://www.upguard.com/blog/cryptography) and[ encryption](https://www.upguard.com/blog/encryption) practices for[ sensitive data](https://www.upguard.com/blog/sensitive-data), such as encrypting data at rest and in transit to protect sensitive information. * Deploy robust[ endpoint protection](https://www.upguard.com/blog/endpoint-detection-and-response) and network and[ information security](https://www.upguard.com/blog/information-security) measures to prevent unauthorized access and attacks. ### Security Technologies and Solutions * Employ comprehensive security solutions, including[ SIEM (Security Information and Event Management)](https://www.upguard.com/blog/siem), SOAR (Security Orchestration, Automation, and Response), and UEBA (User and Entity Behavior Analytics) tools. Ensure these comply with standards such as Common Criteria EAL3+ and support[ GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant),[ Schrems II](https://www.upguard.com/blog/eu-us-privacy-shield), and[ CCPA](https://www.upguard.com/blog/what-is-the-ccpa) regulations. * Use SaaS solutions that comply with EU data residency regulations (such as GDPR compliance for[ data protection](https://www.upguard.com/blog/data-protection-for-third-parties)). Ensure that cloud environments are secured against[ breaches](https://www.upguard.com/blog/data-breach) and unauthorized access. ### Technical Compliance and Certifications * Ensure the use of[ multi-factor authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) and secured communication systems for critical services, including voice, video, and text communications, especially for remote or privileged access. * Apply relevant[ security frameworks](https://www.upguard.com/blog/regulation-vs-cyber-framework) and ensure compliance with standards such as ISO 15408 for technology security and[ ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) for information security management. ### Compliance with Legal and Industry Standards * Understand and implement the requirements of NIS2, noting key differences from the original[ NIS Directive](https://www.upguard.com/blog/nis-directive). * Ensure[ cybersecurity strategies](https://www.upguard.com/blog/reduce-cybersecurity-risk) meet specific requirements pertinent to critical infrastructure sectors such as healthcare ([HIPAA](https://www.upguard.com/blog/hipaa-privacy-rule) compliance), energy ([NERC CIP](https://www.upguard.com/blog/nerc-cip) standards), and finance ([SOX](https://www.upguard.com/blog/sox-compliance) compliance). Implement recognized frameworks to strengthen[ security postures](https://www.upguard.com/blog/security-posture) and standards, such as[ NIST SP 800](https://www.upguard.com/blog/nist-sp-800-53) series,[ ISO/IEC 27001](https://www.upguard.com/blog/what-is-iso-27001),[ CIS Controls](https://www.upguard.com/blog/cis-controls), and[ Mitre Att\&ck](https://www.upguard.com/blog/what-is-threat-modelling#:~:text=10.-,MITRE,-MITRE%20ATT%26CK). ### Reporting and Communication * Develop capabilities to swiftly detect, analyze, and report significant incidents to relevant authorities (such as national CSIRTs) and notify affected stakeholders, adhering to stipulated timelines and content requirements. * Document governance processes and[ cybersecurity](https://www.upguard.com/blog/cybersecurity-important) efforts comprehensively. Use benchmarks such as ISO/IEC 27002:2022 for standard compliance and automate reporting processes as much as possible. ### Human Resources and Training * Implement HR policies that rigorously[ control access](https://www.upguard.com/blog/access-control) based on roles, conduct regular[ security assessments](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment), and enforce strict security training and awareness programs. * Provide personnel with comprehensive training on[ cybersecurity best practices](https://www.upguard.com/blog/reduce-cybersecurity-risk),[ data handling](https://www.upguard.com/blog/data-governance), and compliance obligations. ## Prepare for NIS2 Compliance with UpGuard [Compliance management](https://www.upguard.com/blog/what-is-compliance-management) is an ongoing and difficult challenge, but[ UpGuard](https://www.upguard.com/) helps your organization stay one step ahead with our all-in-one[ external attack surface management platform](https://www.upguard.com/product/breachsight). [UpGuard Breach Risk](https://www.upguard.com/product/breachsight) helps protect your organization’s reputation by understanding the risks impacting your external[ security posture](https://www.upguard.com/blog/security-posture) and knowing your assets are constantly monitored and protected. View your organization’s[ cybersecurity](https://www.upguard.com/blog/cybersecurity-important) at a glance and communicate internally about[ risks](https://www.upguard.com/blog/cybersecurity-risk),[ vulnerabilities](https://www.upguard.com/blog/vulnerability), or current[ security incidents](https://www.upguard.com/blog/biggest-data-breaches). Other features include: * [**Data Leak Detection:**](https://www.upguard.com/product/breachsight/features#monitor-data-protection) Protect your brand, intellectual property, and customer data with timely detection of data leaks and avoid data breaches[‍](https://www.upguard.com/product/breachsight/features#continuous-security-monitoring-section) * [**Continuous Monitoring:**](https://www.upguard.com/product/breachsight/features#continuous-security-monitoring-section) Get real-time information and manage exposures, including domains, IPs, and employee credentials[‍](https://www.upguard.com/product/breachsight/features#attack-surface-reduction-section) * [**Attack Surface Reduction:**](https://www.upguard.com/product/breachsight/features#attack-surface-reduction-section) Reduce your attack surface by discovering exploitable vulnerabilities and domains at risk of typosquatting[‍](https://www.upguard.com/product/breachsight/features#security-profile-section) * [**Shared Security Profile:**](https://www.upguard.com/product/breachsight/features#security-profile-section) Eliminate having to answer security questionnaires by creating an UpGuard Trust Page[‍](https://www.upguard.com/product/breachsight/features#workflows-waivers-section) * [**Workflows and Waivers:**](https://www.upguard.com/product/breachsight/features#workflows-waivers-section) Simplify and accelerate how you remediate issues, waive risks, and respond to security queries[‍](https://www.upguard.com/product/breachsight/features#reporting-insights-section) * [**Reporting and Insights:**](https://www.upguard.com/product/breachsight/features#reporting-insights-section) Access tailor-made reports for different stakeholders and view information about your external attack surface Checklist NIS2 Compliance Checklist Free resource ### NIS2 Compliance Checklist [Download now](/resources/nis2-compliance-checklist) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)