NIS2 Directive Compliance Programme

Tasks in this template

1. 1
   Determine entity classification (essential or important) and sectoral scope D+2

   NIS2 Art. 2 & Annex I/II: classification depends on sector and size. Verify with the competent national authority whether self-registration is required.

2. 2
   Assign executive management accountability for cybersecurity risk D+5
3. 3
   Establish a cybersecurity risk management framework D+7

   NIS2 Art. 21(1): management bodies must approve and oversee cybersecurity risk management measures. Non-compliance may trigger personal liability (Art. 20).

4. 4
   Conduct a network and information systems risk assessment D+10
5. 5
   Document policies on risk analysis and information system security D+14
6. 6
   Define and document the incident handling procedure D+17

   NIS2 Art. 23: early warning within 24h, incident notification within 72h, final report within 1 month of the incident notification.

7. 7
   Establish business continuity and crisis management plans D+21
8. 8
   Implement backup management and disaster recovery procedures D+24
9. 9
   Assess and manage supply chain cybersecurity risk D+28

   NIS2 Art. 21(2)(d) & (3): include security aspects in supplier relationships, assess the overall quality and resilience of suppliers' cybersecurity practices.

10. 10
    Implement secure acquisition, development, and maintenance of systems D+31
11. 11
    Implement vulnerability handling and disclosure procedures D+35
12. 12
    Define and implement policies for cryptography and encryption D+38

    NIS2 Art. 21(2)(h): cryptography and, where appropriate, encryption policies must address data in transit and at rest.

13. 13
    Implement human resources security, access control, and asset management D+42
14. 14
    Implement multi-factor authentication and secured communications D+45
15. 15
    Deliver cybersecurity training for management and staff D+49

    NIS2 Art. 20(2): management bodies must follow training and encourage similar training across their entities on a regular basis.

16. 16
    Establish policies for the use of cryptography across the estate D+52
17. 17
    Set up and test the incident reporting channel to the national CSIRT D+56
18. 18
    Perform a tabletop exercise to validate incident response readiness D+59
19. 19
    Schedule independent audit of the measures D+63
20. 20
    Report to the management body on effectiveness of measures D+70