NIS2 is the EU directive that replaced the original Network and Information Security rules and dramatically widened who has to comply. Many small and mid-sized companies that never thought of themselves as "critical infrastructure" are now in scope, either directly or because an in-scope customer pushes requirements down the supply chain. This checklist is for them.
This article is practical guidance, not legal advice. NIS2 is transposed into national law by each member state with its own deadlines and specifics. Check your national implementation and talk to counsel for the legal side.
Am I in scope?
NIS2 covers "essential" and "important" entities across 18 sectors, including energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, space, postal services, waste, chemicals, food, manufacturing of certain products, digital providers and research. The size thresholds are generally medium-sized enterprises and above (50+ employees or €10M+ turnover), but some entities are in scope regardless of size, and suppliers to in-scope entities are feeling the requirements contractually.
If you are not sure, assume your larger customers will soon ask. Preparing early is cheaper than scrambling after a questionnaire arrives.
What NIS2 actually requires
Article 21 lists the minimum cybersecurity risk-management measures. In plain language:
- Risk analysis and information system security policies.
- Incident handling.
- Business continuity, backup management and disaster recovery.
- Supply chain security, including your relationships with suppliers and service providers.
- Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of your measures.
- Basic cyber hygiene practices and cybersecurity training.
- Cryptography and, where appropriate, encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication, secured communications and secured emergency communications.
On top of that, significant incidents must be reported to the national authority: an early warning within 24 hours, a notification within 72 hours and a final report within a month. Management is personally accountable and must approve the measures and undergo training.
The technical checklist
The policy and governance work is yours to do. The following items are technical, measurable and can be started this quarter. Each one maps to one or more Article 21 measures.
1. Know what you own (asset management)
- Maintain an inventory of internet-facing assets: domains, subdomains, IPs, cloud services.
- Run automated external discovery and reconcile it with the inventory regularly. The gap is your unmanaged risk.
- Maintain an inventory of endpoints with OS version, patch level and installed software.
2. Find and fix vulnerabilities (vulnerability handling)
- Scan external assets for vulnerabilities on a schedule, at least monthly.
- Define remediation deadlines by severity (for example, critical within 7 days) and track them.
- Re-test after fixes and keep the evidence.
3. Detect compromised credentials (access control, incident handling)
- Monitor the dark web for leaked credentials on your domains.
- Enforce MFA on email, VPN and administrative access.
- Have a written procedure for a leaked-credential alert: reset, revoke sessions, review logins.
4. Secure your domains and email (secured communications)
- Deploy SPF, DKIM and DMARC with an enforcing policy and monitor for drift.
- Track TLS certificate expiry and configuration.
- Watch for typosquatting domains impersonating your brand.
5. Harden endpoints (cyber hygiene)
- Patch operating systems and applications within defined windows.
- Detect vulnerable software and suspicious processes on devices centrally.
- Keep backups offline or immutable and test restores.
6. Prove it (effectiveness assessment)
- Map every technical finding to the relevant NIS2 measure and to ISO 27001 controls if you use that framework.
- Export periodic reports for management, who must sign off, and for the authority or auditor on request.
Where tooling helps
Items 1 through 6 are exactly what a continuous monitoring platform automates. SecurityScanner.AI's compliance mapping links dark web, attack surface, domain and endpoint findings directly to NIS2 articles and ISO 27001:2022 controls, with PDF and CSV evidence exports. It does not write your policies, but it makes the technical half of NIS2 something a small IT team can run every week instead of a project every year.
Start this week
- Confirm scope with your national implementation.
- Run a first external discovery and a dark web check on your domains. Both take minutes and tell you where you stand.
- Turn on MFA everywhere it is missing.
- Draft the incident reporting procedure with the 24/72-hour timeline.
- Put a recurring scan schedule in place and assign an owner.