A practical checklist for essential and important entities under the EU's NIS2 Directive.
The checklist
- Confirm you're in scope — an essential or important entity under NIS2's sector and size criteria.
- Register with your national competent authority / CSIRT.
- Adopt cyber risk-management measures (Article 21) — policies, risk analysis, and an all-hazards approach.
- Implement incident handling and business-continuity / crisis-management measures.
- Secure your supply chain and supplier relationships.
- Harden network and information systems — access control, MFA, encryption, and vulnerability handling.
- Establish incident reporting — early warning within 24 hours, notification within 72 hours, final report within one month.
- Ensure management-body oversight — accountability and training for cybersecurity at board level.
- Test and audit your measures regularly.
Residency, by designNIS2 raises the bar on supply-chain and data governance. A sovereign, EU-resident deployment keeps your systems and evidence inside your jurisdiction.
A practical starting checklist, not legal advice. NIS2 is transposed into national law — confirm your obligations with your competent authority.