Resources / Checklist
NIS2 readiness checklist
Updated 16 October 2026
Directive (EU) 2022/2555 (NIS2) sets cybersecurity obligations for essential and important entities in 18 sectors across the EU. This checklist covers the security measures of Article 21, the reporting deadlines of Article 23 and the fines of Article 34. In Greece the Directive applies through Law 5160/2024 and KYA 1689/2025.
The 10 areas of Article 21(2)
Each entity must take appropriate and proportionate measures that cover at least the following.
- Policies on risk analysis and information system securityIn Vardion: Risk register, policy kit and the ISMS records
- Incident handlingIn Vardion: Incident register with the Article 23 deadlines worked out
- Business continuity, such as backup management and disaster recovery, and crisis managementIn Vardion: Business impact analysis, playbooks, exercises and the crisis team
- Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providersIn Vardion: Supplier register, weekly supplier monitoring and questionnaires
- Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosureIn Vardion: Scheduled vulnerability scanning with a fix plan
- Policies and procedures to assess the effectiveness of cybersecurity risk-management measuresIn Vardion: Maturity assessments, internal audits and the evidence pack
- Basic cyber hygiene practices and cybersecurity trainingIn Vardion: Awareness results from phishing simulations and training exports
- Policies and procedures regarding the use of cryptography and, where appropriate, encryptionIn Vardion: TLS, certificate and SSH checks on every scanned service, and DNSSEC for each domain
- Human resources security, access control policies and asset managementIn Vardion: Asset register, owners and identity posture reviews
- The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriateIn Vardion: Multi-factor authentication checks for Microsoft 365 and Google Workspace
Management accountability
Under Article 20, the management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements. Its members must follow cybersecurity training.
Incident reporting deadlines
| Report | Deadline under Article 23(4) |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident |
| Incident notification | Within 72 hours of becoming aware of it |
| Intermediate report | When the CSIRT or the authority asks for one |
| Final report | Within one month of the incident notification; if the incident is still ongoing then, a progress report, and the final report within one month of handling it |
Fines
| Entity | Maximum fine of at least (Article 34(4) and (5)) |
|---|---|
| Essential | €10,000,000 or 2% of total worldwide annual turnover, whichever is higher |
| Important | €7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher |
Work through the checklist in Vardion
- See whether NIS2 is likely to apply to you under Articles 2 and 3, and as an essential or an important entity.
- See which Article 21(2) measure each finding on your systems puts at risk.
- Never miss a reporting deadline: the 24-hour, 72-hour and one-month clocks start from the times you record.
- Hand your auditor one evidence pack, with checksums.
See the NIS2 tools in Vardion
A demo walks through the assessments, deadlines and evidence. The free check grades your domain's email security and DNS in under a minute.