NIS2 Directive: The 2026 Compliance Landscape
The NIS2 Directive (EU 2022/2555) represents the most significant overhaul of European cybersecurity regulation since the original NIS Directive of 2016. With enforcement now fully active across EU member states, organizations in essential and important sectors must demonstrate compliance or face penalties of up to €10 million or 2% of global turnover.
This checklist provides a structured approach to achieving and maintaining NIS2 compliance in 2026, based on Fidem Cybersecurity’s experience guiding organizations through the compliance process.
Who Must Comply with NIS2?
NIS2 significantly expands the scope of covered entities compared to the original directive:
Essential Entities (Stricter Requirements)
- Energy (electricity, oil, gas, hydrogen)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Healthcare (hospitals, laboratories, pharmaceuticals)
- Drinking water and wastewater
- Digital infrastructure (DNS, TLD registries, cloud providers, data centers)
- ICT service management (managed service providers, managed security providers)
- Public administration (central government)
- Space sector
Important Entities (Standard Requirements)
- Postal and courier services
- Waste management
- Chemical manufacturing and distribution
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery, vehicles)
- Digital providers (online marketplaces, search engines, social platforms)
- Research organizations
NIS2 Compliance Checklist
1. Governance and Risk Management
- ☐ Appoint a dedicated cybersecurity officer or CISO responsible for NIS2 compliance
- ☐ Establish a board-level cybersecurity governance framework (management body liability is now explicit under NIS2)
- ☐ Conduct a comprehensive risk assessment covering all critical information systems
- ☐ Implement a risk management framework aligned with ISO 27001 or equivalent
- ☐ Document risk treatment plans with clear ownership and timelines
- ☐ Ensure management body members receive cybersecurity training
2. Incident Response and Reporting
- ☐ Establish a 24/7 incident detection and response capability (internal SOC or managed service)
- ☐ Implement the mandatory reporting timeline: early warning within 24 hours, incident notification within 72 hours, final report within 1 month
- ☐ Identify and register with the relevant national CSIRT (Computer Security Incident Response Team)
- ☐ Document incident response procedures and conduct tabletop exercises quarterly
- ☐ Maintain an incident log with full timeline, impact assessment, and remediation actions
3. Supply Chain Security
- ☐ Map all critical ICT supply chain dependencies
- ☐ Assess cybersecurity posture of key suppliers and service providers
- ☐ Include cybersecurity requirements in procurement contracts
- ☐ Monitor supplier security posture continuously (consider ASM for third-party visibility)
- ☐ Develop contingency plans for supply chain disruptions
4. Technical Security Measures
- ☐ Deploy multi-factor authentication (MFA) for all privileged and remote access
- ☐ Implement network segmentation to limit lateral movement
- ☐ Deploy endpoint detection and response (EDR) on all critical systems
- ☐ Establish vulnerability management program with regular scanning and patching
- ☐ Implement encryption for data at rest and in transit
- ☐ Deploy email security controls (anti-phishing, DMARC, SPF, DKIM)
- ☐ Implement secure backup strategy with offline/immutable copies (3-2-1 rule)
- ☐ Conduct regular penetration testing (at least annually, more for essential entities)
5. Business Continuity
- ☐ Develop and maintain a Business Continuity Plan (BCP) covering cyber incidents
- ☐ Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical services
- ☐ Test disaster recovery procedures at least semi-annually
- ☐ Ensure backup systems are isolated from primary infrastructure
6. Awareness and Training
- ☐ Implement a cybersecurity awareness program for all employees
- ☐ Conduct phishing simulation campaigns quarterly
- ☐ Provide role-specific security training for IT and development teams
- ☐ Document training records for audit purposes
7. Audit and Compliance Documentation
- ☐ Maintain a compliance evidence repository (policies, procedures, logs, test results)
- ☐ Schedule annual internal audits of NIS2 compliance
- ☐ Prepare for supervisory authority inspections (essential entities face proactive supervision)
- ☐ Document all security policies and ensure they are reviewed annually
NIS2 Penalties for Non-Compliance
The penalties under NIS2 are significantly more severe than its predecessor:
| Entity Type | Maximum Fine |
|---|---|
| Essential Entities | €10,000,000 or 2% of global annual turnover (whichever is higher) |
| Important Entities | €7,000,000 or 1.4% of global annual turnover (whichever is higher) |
Additionally, NIS2 introduces personal liability for management body members who fail to ensure compliance, including potential temporary bans from holding management positions.
How Fidem Cybersecurity Supports NIS2 Compliance
Fidem Cybersecurity provides end-to-end NIS2 compliance support through a combination of consulting and managed security services:
- Gap Analysis: Comprehensive assessment of your current security posture against NIS2 requirements
- Risk Assessment: ISO 27001-aligned risk assessment and treatment planning
- Managed SOC/MDR: 24/7 incident detection and response via Defensio SOC, meeting NIS2’s incident response requirements
- Attack Surface Management: Continuous external monitoring via Defensio XT for supply chain and asset visibility
- Penetration Testing: Regular penetration tests and vulnerability assessments to validate technical controls
- Phishing Campaigns: Simulated phishing exercises for employee awareness training
- DPO Services: Outsourced Data Protection Officer for integrated GDPR + NIS2 compliance
As an ISO 27001:2022 and ISO 9001:2015 certified cybersecurity consultancy, Fidem brings the operational maturity and technical expertise required to guide organizations through the NIS2 compliance journey.
Contact us for a NIS2 readiness assessment and discover where your organization stands.