NIS2 readiness checklist for 2026: what to fix in the next 90 days

NIS2 readiness checklist for 2026: what to fix in the next 90 days

NIS2 implementation is not measured by policy volume. It is measured by whether governance, incident response, and evidence workflows actually work under pressure. This checklist helps teams close the most important gaps quickly.

1) Scope and ownership

• Confirm which entities and services are in scope under NIS2.
• Assign a clear NIS2 owner with business and technical accountability.
• Define the interface with the national competent authority and CSIRT.

2) Management governance

• Set explicit management accountability for cyber risk oversight.
• Implement a recurring review cadence (for example monthly).
• Document escalation triggers from operations to executive level.

3) Risk management baseline

• Keep an up-to-date map of critical assets, services, and dependencies.
• Ensure vulnerability management is measurable (priorities, SLAs, closure).
• Tie cyber-risk assessment to business impact, not only technical severity.

4) Incident reporting readiness

• Run a simulation for “significant incident” qualification.
• Define who decides reportability and who approves external wording.
• Validate that reporting workflows are documented and time-realistic.

5) Supply-chain cyber controls

• Prioritize critical third parties and dependency risks.
• Include security and notification requirements in supplier contracts.