NIS2 compliance, measured against the Directive

1. Has your management body formally approved a cybersecurity strategy aligned with NIS2 requirements?

2. Are members of the management body required to undergo regular cybersecurity training?

3. Is there a designated CISO or equivalent role with direct reporting to the board?

4. Does the organisation have a documented cybersecurity governance framework with defined roles and responsibilities?

5. Are cybersecurity risk assessments reviewed and approved at board level at least annually?

6. Is there a formal process for the management body to oversee the implementation of cybersecurity measures?

7. Has the organisation established liability and accountability mechanisms for management body members regarding cybersecurity failures?

1. Does the organisation maintain a comprehensive and regularly updated cybersecurity risk register?

2. Is there a formal risk assessment methodology (e.g., ISO 27005, NIST RMF) applied consistently?

3. Are risk treatment plans documented with clear owners, timelines, and acceptance criteria?

4. Does the organisation conduct risk assessments before deploying new systems or making significant changes?

5. Are residual risks formally accepted by appropriate management levels?

6. Is there a process to identify and assess risks from emerging threats and vulnerabilities?

7. Are risk assessment results used to prioritise cybersecurity investments and resource allocation?

1. Is there a documented incident response plan that includes NIS2 reporting timelines (24-hour early warning, 72-hour incident notification, final report within one month)?

2. Has the organisation identified and documented the relevant CSIRT/competent authority for incident reporting?

3. Are there automated systems in place for detecting and classifying cybersecurity incidents?

4. Is there a defined process for determining whether an incident is 'significant' under NIS2 criteria?

5. Does the organisation conduct post-incident reviews and document lessons learned?

6. Are incident response procedures regularly tested through tabletop exercises or simulations?

7. Is there a communication plan for notifying affected service recipients of significant incidents?

1. Does the organisation maintain an inventory of all critical suppliers and their cybersecurity risk profiles?

2. Are cybersecurity requirements included in contracts with suppliers and service providers?

3. Is there a formal supplier risk assessment process conducted before onboarding and periodically thereafter?

4. Does the organisation monitor suppliers for cybersecurity incidents that could affect its operations?

5. Are there documented procedures for managing and revoking supplier access in case of security concerns?

6. Does the organisation assess the cybersecurity practices of sub-contractors within its supply chain?

7. Is there a process to evaluate and mitigate concentration risks in the supply chain?

1. Is there a formal access control policy based on the principle of least privilege?

2. Is multi-factor authentication (MFA) enforced for all privileged and remote access?

3. Are user access rights reviewed and recertified at regular intervals?

4. Is there a privileged access management (PAM) solution in place with session recording?

5. Are automated processes in place for provisioning and de-provisioning user accounts?

6. Does the organisation enforce strong password policies or passwordless authentication?

7. Is there a process to detect and respond to compromised credentials?

1. Is the network segmented to isolate critical systems and limit lateral movement?

2. Are firewalls, IDS/IPS, and other network security controls deployed and regularly updated?

3. Is there an endpoint detection and response (EDR) solution deployed across all endpoints?

4. Does the organisation maintain a complete and up-to-date asset inventory of all IT systems?

5. Is there a formal vulnerability management programme with defined SLAs for patching?

6. Are security configurations (hardening baselines) applied consistently across all systems?

7. Does the organisation conduct regular penetration testing of critical infrastructure?

1. Is there a formal cloud security policy covering all IaaS, PaaS, and SaaS deployments?

2. Are cloud configurations assessed against security benchmarks (e.g., CIS Benchmarks)?

3. Does the organisation have visibility into cloud workload security posture (CSPM/CWPP)?

4. Are cloud access controls and identity federation properly configured and monitored?

5. Is there a process for secure deployment using infrastructure-as-code with security scanning?

6. Does the organisation assess data residency and sovereignty requirements for cloud services?

7. Are cloud service provider security certifications and compliance reports reviewed regularly?

1. Is data encrypted at rest and in transit using industry-standard algorithms (e.g., AES-256, TLS 1.3)?

2. Is there a formal cryptographic key management policy with defined key lifecycle procedures?

3. Does the organisation have a data classification scheme that determines protection requirements?

4. Are data loss prevention (DLP) controls implemented for sensitive data?

5. Is there a process for secure data disposal and media sanitisation?

6. Does the organisation maintain an inventory of cryptographic assets and certificates?

7. Are backup data encrypted and stored in compliance with data protection requirements?

1. Does the organisation operate or subscribe to a 24/7 Security Operations Centre (SOC)?

2. Is there a SIEM platform collecting and correlating logs from all critical systems?

3. Are security logs retained for a minimum period compliant with regulatory requirements?

4. Are there defined use cases and detection rules for known attack patterns (MITRE ATT&CK)?

5. Does the organisation use threat intelligence feeds to enhance detection capabilities?

6. Are SOC analysts trained and certified to handle NIS2-relevant incident types?

7. Is there an automated alerting and escalation process for high-severity security events?

1. Does the organisation have a documented business continuity plan (BCP) covering cybersecurity scenarios?

2. Is there a disaster recovery plan with defined RTOs and RPOs for critical systems?

3. Are backup systems tested regularly to ensure data can be restored within defined timeframes?

4. Is there a crisis management team with defined roles and communication procedures?

5. Does the organisation conduct business impact analyses (BIA) for cybersecurity disruptions?

6. Are BC/DR plans tested through regular exercises (at least annually)?

7. Is there redundancy and failover capability for critical network and information systems?

1. Does the organisation have a mandatory cybersecurity awareness training programme for all employees?

2. Are phishing simulation exercises conducted regularly to test employee awareness?

3. Is there role-specific security training for IT staff, developers, and administrators?

4. Are training completion rates tracked and reported to management?

5. Does the organisation provide training on NIS2-specific obligations and reporting requirements?

6. Is there a process to update training content based on emerging threats and incident lessons learned?

7. Are third-party contractors and temporary staff included in the security awareness programme?

1. Does the organisation participate in sector-specific information sharing groups (ISACs/ISAOs)?

2. Are there established channels for sharing threat intelligence with competent authorities?

3. Is there a formal policy for sharing cybersecurity information while protecting sensitive data?

4. Does the organisation consume and act upon shared threat intelligence from external sources?

5. Are there NDAs or information sharing agreements in place with sharing partners?

6. Is shared intelligence integrated into the organisation's detection and response processes?

7. Does the organisation contribute to coordinated vulnerability disclosure processes?

1. Has the organisation conducted a formal gap analysis against NIS2 requirements?

2. Is there an internal audit programme that covers cybersecurity controls and NIS2 compliance?

3. Are external audits or certifications (e.g., ISO 27001) obtained and maintained?

4. Is there a compliance monitoring process that tracks regulatory changes and their impact?

5. Does the organisation maintain documentation sufficient for regulatory inspections?

6. Are audit findings tracked with remediation plans and defined closure timelines?

7. Is there a process for continuous improvement of cybersecurity measures based on audit results?