NIS2 compliance checklist: what to do now, what to document, and where GDPR fits

In today’s Brussels briefing, regulators underlined that NIS2 is no longer a future worry—it’s operational reality across the EU. This NIS2 compliance checklist distills what essential and important entities must implement, how it differs from GDPR, and practical steps to cut breach and audit risk. As I heard from a CISO at a Eurozone bank, “2026 is the year supervisors scrutinize evidence—policies on paper won’t pass.”

Why NIS2 matters in 2026

• NIS2 replaced and expanded the original NIS Directive. Member States had to transpose by October 2024; in 2026, national authorities are actively supervising and requesting audit evidence.
• Scope is broader: energy, transport, health, finance, public administration, digital infrastructure, managed services, cloud, data centers, and more.
• Fines bite: for essential entities, up to at least €10 million or 2% of worldwide turnover; for important entities, up to at least €7 million or 1.4%—on top of possible GDPR penalties if personal data is involved.

In recent months, we’ve seen a CVSS 10.0 remote code execution in a popular automation platform and a critical 9.0 flaw in a backup product. Incidents like these are exactly what NIS2’s risk-management and reporting rules aim to address—supply chain exposure, misconfigurations, and rapid detection and reporting.

NIS2 compliance checklist (the essentials)

Use this NIS2 compliance checklist to baseline your program and evidence readiness for security audits by national competent authorities:

• Governance and accountability
  • Board oversight: security risk on the agenda; management training completed and documented.
  • Named accountable executive for NIS2 with clear RACI.
• Risk management and controls
  • Documented risk assessment covering assets, threats, vulnerabilities, and business impact.
  • Technical measures: network segmentation, MFA, EDR/XDR, vulnerability management, patch SLAs, backup/restore testing.
  • Operational measures: change management, secure software development, supplier due diligence.
  • Business continuity and disaster recovery playbooks with tested RTO/RPO.
• Incident detection and reporting
  • 24/7 monitoring and on-call procedures; validated alert triage workflows.
  • Reporting timeline aligned with NIS2: early warning within 24 hours, follow-up within 72 hours, and a final report within one month.
• Supply chain and third parties
  • Contractual security clauses, audit rights, and timely vulnerability notification obligations.
  • Third-party risk tiers mapped to enhanced controls and continuous monitoring.
• Data protection alignment
  • Where incidents include personal data, GDPR breach notification (72 hours) coordinated with NIS2 reporting.
  • Use an AI anonymizer for redacting personal data in tickets, logs, and evidence bundles.
• Secure workflows for evidence
  • Centralized, access-controlled repository for policies, risk registers, and incident evidence.
  • Use secure document uploads for sharing PDFs, DOCs, and images with auditors and internal stakeholders.

Professionals avoid risk by using Cyrolo’s anonymizer at www.cyrolo.eu. Try our secure document upload at www.cyrolo.eu—no sensitive data leaks.

GDPR vs NIS2: what’s the difference, really?

Legal teams often ask me whether “GDPR compliance” is enough. Short answer: no. GDPR is about personal data protection; NIS2 is about the resilience of networks and services, including—but not limited to—personal data. Many organizations must comply with both.

Topic	GDPR	NIS2
Primary focus	Personal data protection and rights	Cybersecurity risk management and service continuity
Who is in scope	Controllers and processors handling personal data	Essential and important entities in specified sectors and sizes; some smaller entities if critical
Security obligations	“Appropriate” technical/organizational measures	Specific baseline: risk management, incident response, supply-chain security, BCP/DR, crypto, logging, and more
Breach reporting	72 hours to the DPA if personal data breach likely risks rights/freedoms	Early warning within 24h, notification within 72h, final report within 1 month to competent authority/CSIRT
Supervision	Data Protection Authorities (DPAs)	National competent authorities and CSIRTs; proactive and reactive supervision
Fines	Up to €20m or 4% global turnover	Essential: up to at least €10m or 2%; Important: up to at least €7m or 1.4%

NIS2 compliance checklist in action: scenarios regulators ask about

• Hospitals: Can you isolate a compromised medical IoT network without disrupting critical care? Show tabletop results and network segmentation diagrams.
• Banks and fintechs: Do you have validated restore times for core banking after ransomware? Provide backup integrity reports and immutable storage evidence.
• Managed service providers: How do you prevent supply-chain blast radius? Share customer isolation designs and third-party access controls.
• Cloud and data centers: Are tenant logs tamper-evident, and can you furnish incident evidence without exposing other tenants’ data? Demonstrate chain-of-custody.
• Public administration: Do you have a 24/72/30-day incident reporting workflow? Produce your runbooks and real drill output.

When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.

Risk trends I’m watching from Brussels

• Zero trust meets AI: Security teams are piloting AI-driven detections for “fileless” and indicator-less attacks. Supervisors are asking how you validate these models and avoid bias or blind spots.
• Non-human identities: Service accounts, bots, and machine credentials are exploding. A CISO I interviewed warned, “Our biggest lateral movement comes from poorly scoped robot accounts.” Inventory and rotate them.
• Email and DNS misroutes: Misconfigured routing can enable internal-domain phishing at scale. NIS2 expects hardening—and proof you monitor for drifts.
• Patch velocity: With critical RCEs surfacing in automation pipelines and backup systems, your patch SLAs and compensating controls must be evidence-backed.

Documentation that passes audits (and avoids oversharing)

NIS2 reviews increasingly focus on verifiable evidence, not policy prose. That means:

• Risk register entries mapped to actual control owners and test dates.
• Ticket histories proving time-to-detect and time-to-remediate.
• Supplier proofs: SOC 2/ISO certificates, SBOMs, vulnerability notification windows, and incident coordination clauses.
• Redacted artifacts: Logs, diagrams, and screenshots with personal data and secrets removed.

This is where privacy and security converge. Before sharing files with auditors or feeding documents to an internal LLM, anonymize them. Use an AI anonymizer to strip names, emails, IDs, and free-text PII. Then rely on secure document uploads to distribute evidence safely inside your organization.

EU vs US: different playbooks, same accountability

While the EU pushes horizontal rules (GDPR, NIS2, DORA for financial ICT risk), the US remains more sector-led with overlapping state and federal guidance. The direction of travel is common: stronger governance, faster incident reporting, and demonstrable resilience. If you operate transatlantically, align on the strictest common denominator and document once, report many.

How Cyrolo helps reduce NIS2 exposure

• Pre-share data hygiene: Automatically redact personal data and sensitive terms from PDFs, Word files, images, and exports before they leave your environment.
• Controlled distribution: Centralize evidence with access controls to limit who sees what during audits and crisis collaboration.
• LLM-safe workflows: Prepare content for internal AI analysis without risking confidential leaks.

Protect your team and your customers. Professionals avoid risk by using Cyrolo’s anonymizer at www.cyrolo.eu. Try our secure document upload at www.cyrolo.eu—no sensitive data leaks.

Quick-start roadmap (90 days)

1. Week 1–2: Confirm entity classification (essential or important), map applicable national transposition, assign accountable executive.
2. Week 3–4: Refresh enterprise risk assessment; gap-map controls to NIS2; set patch SLAs for critical systems.
3. Week 5–6: Validate incident playbooks and the 24h/72h/30d reporting pipeline; run a tabletop on a supply-chain RCE scenario.
4. Week 7–8: Tier suppliers; update contracts with notification windows and security clauses; set continuous monitoring.
5. Week 9–10: Implement log retention, EDR, backups with immutable copies; test restores against ransomware.
6. Week 11–12: Anonymize and stage audit evidence; deploy secure file workflows so teams stop emailing sensitive attachments.

FAQ

What is NIS2 compliance and who needs it?

NIS2 compliance means meeting the EU’s cybersecurity risk management and incident reporting obligations for essential and important entities across specified sectors. Many medium and large organizations in energy, health, finance, transport, digital infrastructure, cloud/MSPs, and public administration are in scope; some smaller entities can be included if critical.

What is the NIS2 incident reporting timeline?

Authorities expect an early warning within 24 hours of becoming aware of a significant incident, a more complete notification within 72 hours, and a final report within one month.

Does NIS2 replace GDPR?

No. They coexist. GDPR governs personal data; NIS2 governs service resilience and cybersecurity. A single incident can trigger both regimes, so coordinate reporting and evidence.

How can I anonymize evidence to share with regulators?

Use an AI anonymizer to redact personal data and secrets in logs, tickets, screenshots, and emails before sharing. Then use secure document uploads to distribute files inside your organization without exposure.

Is NIS2 enforced uniformly across the EU?

It’s a directive, so details depend on national transposition. However, the core obligations and reporting timelines are consistent, and supervisors are converging on similar audit expectations.

Conclusion: use this NIS2 compliance checklist to prove resilience—safely

NIS2 is now a daily operational reality. Use this NIS2 compliance checklist to structure governance, tighten controls, and prepare audit-ready evidence without risking privacy breaches. Before you share or analyze files, anonymize and centralize them. Professionals across the EU reduce risk with the anonymizer and secure uploads at www.cyrolo.eu. When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.