Free templates
NIS2 gap checklist
Go through the ten measures of NIS2 Article 21(2) with your team: answer each question, agree on an owner and a date, and note the evidence you have.
How to use it
- 1Download the file for Excel, or print it.
- 2Fill in the empty columns with your team or your suppliers.
- 3Agree on owners and dates, and check again in a few months.
What is inside: 10 items
(a) Risk analysis and security policies
Do you have a written risk analysis and an information security policy approved by management?
First step: List your important systems and what could go wrong with each, then write a short security policy and have management approve it.
(b) Incident handling
Do you know how to detect, handle and report a security incident, including who calls the authority?
First step: Write a one-page incident plan: who decides, who to call, and the 24 hour, 72 hour and one month reporting deadlines.
(c) Business continuity and backups
Do you have tested backups and a plan to keep working or recover after a major outage?
First step: Check that backups of key data are kept separately, restore one as a test, and write down how you would keep working without your main systems.
(d) Supply chain security
Do you know which suppliers you depend on and have you checked their security?
First step: List your suppliers with what they deliver and which data they reach, then ask the critical ones for proof of their security.
(e) Secure acquisition, development and maintenance
Are security and vulnerability handling part of buying, building and updating your systems?
First step: Set a rule to install security updates within a fixed time and add security questions to how you choose new software.
(f) Checking that measures work
Do you regularly check whether your security measures actually work?
First step: Plan a yearly review or internal audit of your measures and record what you found and fixed.
(g) Cyber hygiene and training
Do staff and management get regular security awareness training?
First step: Run a short awareness training for everyone, including management, and repeat it every year.
(h) Cryptography and encryption
Do you have rules for when and how data is encrypted?
First step: Encrypt laptops, phones and backups, use secure connections everywhere, and write down these rules.
(i) People, access control and assets
Do you control who can access what, keep an asset list and remove access when people leave?
First step: Keep a list of devices and systems, give access only as needed, and remove access on the day someone leaves.
(j) Multi-factor authentication and secure communication
Is multi-factor authentication switched on for important accounts, and do you have a secure way to communicate in an emergency?
First step: Switch on multi-factor authentication for email, admin and remote access first, and agree on a backup channel for emergencies.
| Measure | Question | First step | Status (Yes / Partly / No) | Owner | Evidence | Due date | Notes |
|---|---|---|---|---|---|---|---|
| (a) Risk analysis and security policies | Do you have a written risk analysis and an information security policy approved by management? | List your important systems and what could go wrong with each, then write a short security policy and have management approve it. | |||||
| (b) Incident handling | Do you know how to detect, handle and report a security incident, including who calls the authority? | Write a one-page incident plan: who decides, who to call, and the 24 hour, 72 hour and one month reporting deadlines. | |||||
| (c) Business continuity and backups | Do you have tested backups and a plan to keep working or recover after a major outage? | Check that backups of key data are kept separately, restore one as a test, and write down how you would keep working without your main systems. | |||||
| (d) Supply chain security | Do you know which suppliers you depend on and have you checked their security? | List your suppliers with what they deliver and which data they reach, then ask the critical ones for proof of their security. | |||||
| (e) Secure acquisition, development and maintenance | Are security and vulnerability handling part of buying, building and updating your systems? | Set a rule to install security updates within a fixed time and add security questions to how you choose new software. | |||||
| (f) Checking that measures work | Do you regularly check whether your security measures actually work? | Plan a yearly review or internal audit of your measures and record what you found and fixed. | |||||
| (g) Cyber hygiene and training | Do staff and management get regular security awareness training? | Run a short awareness training for everyone, including management, and repeat it every year. | |||||
| (h) Cryptography and encryption | Do you have rules for when and how data is encrypted? | Encrypt laptops, phones and backups, use secure connections everywhere, and write down these rules. | |||||
| (i) People, access control and assets | Do you control who can access what, keep an asset list and remove access when people leave? | Keep a list of devices and systems, give access only as needed, and remove access on the day someone leaves. | |||||
| (j) Multi-factor authentication and secure communication | Is multi-factor authentication switched on for important accounts, and do you have a secure way to communicate in an emergency? | Switch on multi-factor authentication for email, admin and remote access first, and agree on a backup channel for emergencies. |
A self-assessment, not an audit: it shows where to start, not whether you meet the law. Your country's NIS2 law decides the details.
Do it in CloudSignLab
Track the ten measures with owners, evidence and a readiness score, and keep everything up to date.
Get new templates and NIS2 news
Optional: we email you when we publish a new template or guide. You confirm by email first and can unsubscribe at any time.