Introduction
This guide provides a practical checklist for conducting an internal screening on whether your organization is subject to the NIS2 directive. The aim is to give concrete steps, asset and service examples to map, and priority tasks to decide whether to start a more comprehensive compliance project.
Why assess NIS2 applicability
- NIS2 introduces requirements for cyber risk management, incident reporting and governance for "essential" and "important" entities. The formal designation and thresholds are set by national transposition laws.
- Even if an organization is not automatically subject to NIS2, contractual relationships with covered entities or providing critical services can impose contractual obligations and audit requirements.
Step 0 — prepare the screening (10–30 minutes)
- Appoint an internal owner (e.g., security lead, DPO or CTO) to coordinate the screening.
- Gather basic company documents: org chart, list of commercial and IT services, major customers and critical suppliers.
- Create a temporary registry (shared spreadsheet) to record checklist answers.
10-point operational checklist (initial assessment)
- Sector and services
- Check if the organization operates in sectors commonly covered by NIS2: energy, transport, health, water, digital infrastructure, financial services, public services, waste management, etc. (consult national law for the definitive list).
- Service types
- Identify critical services provided: electricity supply, network management, hosting/data centers, cloud infrastructure, payment services, emergency services, water treatment, industrial control systems (ICS/SCADA), centralized email services.
- Size and thresholds
- Collect company size metrics: employee count, turnover, and balance sheet. Exact thresholds for inclusion are defined by national transposition; many implementations consider large enterprises and providers of critical services.
- Customers and geographic impact
- Assess whether customers include public authorities or critical infrastructure, or if services have cross-border or regional impact.
- Third‑party dependencies
- Map critical suppliers and subcontractors (cloud, MSPs, OT/ICS vendors). Suppliers to covered entities may face contractual security and incident-reporting requirements.
- Technical and operational assets
- Inventory critical assets: data centers, backbone networks, central authentication systems (AD/LDAP), customer databases, billing systems, OT devices, network gateways, backups.
- Continuity and incident response processes
- Check for existence of continuity plans, backups and incident response playbooks. Lack of these can indicate a significant gap relative to NIS2 expectations.
- Contractual and regulatory obligations
- Review existing clauses with customers or public bodies requiring security standards, audits or incident notifications.
- Logging and reporting capabilities
- Verify if centralized logging, monitoring and log retention systems exist for forensic analysis and reporting.
- Governance and accountability
- Identify whether there is executive-level responsibility for cyber risk management (e.g., board oversight). NIS2 emphasizes governance and accountability.
Concrete examples of assets and processes to map
- IT infrastructure: production servers, firewalls, VPNs, identity management systems.
- OT infrastructure: PLCs, SCADA, industrial sensors, control networks.
- Cloud and virtual services: IaaS, PaaS, SaaS provided to critical customers.
- Payment and clearing systems; customer portals and public-facing interfaces.
- Telecommunications: interconnection points, DNS, transit providers.
If the checklist indicates potential applicability
- Perform a legal check: consult national transposition rules and seek legal advice if necessary.
- Contact the designated national competent authority for practical clarifications (contact details are published by national administrations).
- Draft an action plan: technical gap analysis, organizational adaptation plan, timeline and budget.
Priority actions (first 90 days recommended)
- Document screening results and rationale (for audit and due-diligence purposes).
- Implement or strengthen incident handling procedures and internal notification flows.
- Add minimum contractual clauses with critical suppliers: incident notification, security controls and audit rights.
- Start basic hardening: patch management, privileged access control, network segmentation for critical assets.
Minimum documentation to keep
- Screening registry with evidence (who answered, dates, documents consulted).
- Inventory of critical assets and supplier map.
- Incident response plans and test/exercise reports.
- Updated contracts with security clauses and SLAs.
Recommendations and limits of this guide
This guide is intended as an operational tool for an initial internal screening. Formal determination of applicability depends on national transposition and any official lists. For binding decisions or complex regulatory obligations, involve legal counsel and cybersecurity specialists.
Quick checklist (summary)
- Owner appointed and registry started
- Sectors and services cataloged
- Critical assets inventoried
- Critical suppliers mapped
- Incident response processes documented
- Evidence and documents archived
Next steps
Start the screening today: appoint the owner, populate the registry and schedule a 1–2 hour meeting to complete the checklist with technical and legal stakeholders.
