NIS2 Compliance Checklist: EU-Proof Your Security Program in 2025

From Brussels this morning, regulators underlined a simple truth: the era of voluntary cybersecurity is over. If you operate in Europe, you now need a living, auditable NIS2 compliance checklist that can stand up to inspections, cross-border incident reporting, and board-level accountability. With attackers abusing business email and calendar workflows (think malicious ICS invitations and zero-days) and EU authorities tightening supervision post-transposition, 2025 is the year to close gaps between policy and practice.

What is NIS2 and why it matters in 2025

NIS2 (Directive (EU) 2022/2555) is the EU’s updated cybersecurity baseline for essential and important entities across sectors such as energy, transport, health, finance, digital infrastructure, and managed services. It complements, not replaces, the GDPR. If GDPR focuses on personal data, NIS2 focuses on the resilience of services. Together, they raise the bar for governance, risk management, supply-chain security, incident reporting, and executive accountability.

• Scope expansion: Many mid-market providers are now in scope as “important entities.”
• Stricter duties: Risk assessments, security policies, vulnerability management, logging, crypto, and business continuity are required—not “nice to have.”
• Faster incident reporting: Early warning within 24 hours, an intermediate report within 72 hours, and a final report within one month of a significant incident.
• Board liability: Management bodies must approve and oversee cybersecurity, and can face sanctions for negligence.

Unlike US frameworks that are often voluntary or fragmented by state, NIS2 is enforceable across the EU. National laws are now live or imminently enforceable in 2025, with inspections and requests for evidence expected to intensify.

GDPR vs NIS2 obligations: where they overlap—and where they don’t

Topic	GDPR	NIS2
Primary Objective	Protect personal data and privacy rights of individuals	Ensure cybersecurity and resilience of essential/important services
Scope	Any controller/processor handling EU personal data	Sector-based essential and important entities (including many providers)
Incident Reporting	Notify data protection authority within 72 hours if personal data breach likely to risk rights/freedoms	Early warning within 24 hours, 72-hour update, final report within 1 month for significant incidents
Security Measures	“Appropriate” technical and organizational measures; DPIAs for high risk	Risk management, supply-chain security, vulnerability management, logging, crypto, BCP/DR, testing
Enforcement & Fines	Up to €20M or 4% global turnover (whichever higher)	Up to €10M or 2% (essential entities); up to €7M or 1.4% (important entities), plus orders and inspections
Board Accountability	Implied via accountability principle and governance duties	Explicit management oversight duties; potential liability for non-compliance

NIS2 compliance checklist: your 90-day action plan

I compiled this from interviews with CISOs at a regional bank, a hospital group, and a pan-EU MSP, plus a recent briefing with national regulators. Treat it as a living artefact—update quarterly and after any major incident or audit.

1) Governance and accountability

• Appoint a management-level owner for NIS2 with board reporting.
• Approve a cybersecurity policy that references NIS2 controls and audit program.
• Define incident severity thresholds and an internal “24/72/1-month” playbook.
• Train executives annually; record attendance and competency outcomes.

2) Risk management and asset inventory

• Maintain a complete asset inventory: hardware, software, SaaS, third parties, and data flows.
• Run a threat-led risk assessment focused on business services, not just IT assets.
• Map risks to controls; document residual risk and explicit acceptance by management.

3) Technical controls you must evidence

• Identity and access management: enforce MFA for admins and remote access; privileged access with JIT/JEA.
• Network security: segment critical systems; restrict east-west traffic; apply email authentication (DMARC, SPF, DKIM).
• Vulnerability and patching: 14–30 day SLA for high/critical; emergency patching for actively exploited CVEs.
• Logging and monitoring: centralized logs with retention; alerting for anomalous auth, data exfil, and ICS/calendar abuse.
• Encryption: data-in-transit and at-rest with modern cipher suites; cryptographic key lifecycle management.
• Backups and recovery: immutability or air-gapping; quarterly restore tests including ransomware scenarios.

4) Email and collaboration hardening

• Sandbox file and calendar attachments; strip risky ICS/HTML content by default for external senders.
• User banners for external emails; block auto-forwarding to personal accounts.
• Phishing-resistant MFA; conditional access for untrusted devices and locations.

5) Supply chain and MSP oversight

• Tier vendors by criticality; require security attestations and right-to-audit clauses.
• Verify MSPs meet NIS2-aligned controls and have their own incident reporting discipline.
• Run tabletop exercises with key suppliers; include comms and legal counsel.

6) Incident reporting mechanics

• Pre-register contacts with your national CSIRT/competent authority.
• Prepare templates: 24-hour early warning, 72-hour update, 1-month final report.
• Measure MTTD/MTTR; rehearse breach notification coordination with GDPR DPO.

7) Data protection and AI usage

• Prevent sensitive or personal data from entering unmanaged AI tools and public LLMs.
• Redact PII and secrets before sharing or collaborating—professionals avoid risk by using Cyrolo’s anonymizer.
• Centralize document intake to a controlled environment; try our secure document reader to keep uploads safe and auditable.

Compliance reminder: When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.

Sector playbooks: what “good” looks like in the real world

Banks and fintechs

• Prioritize swift detection of account-takeover attempts and BEC targeting treasury operations.
• Adopt transaction-level anomaly detection and strong out-of-band approvals.
• Keep executive comms in secure channels; redact client identifiers in analyst prompts using an AI anonymizer.

Hospitals and healthcare providers

• Segment EHR and imaging networks; test downtime procedures quarterly.
• Restrict vendor remote access; verify patching of medical devices under vendor SLAs.
• Use a secure document reader when triaging referrals to avoid sensitive data leakage.

Law firms and professional services

• Client confidentiality first: enforce DLP on email and collaboration suites.
• Mandate safe summarization workflows that anonymize names, case numbers, and financials before AI use.
• Keep chain-of-custody logs for evidence sets and discovery exports.

Municipalities and public administration

• Centralize citizen services behind secure identity; harden mail gateways against ICS exploits.
• Publish incident communication templates; practice multilingual crisis comms.
• Leverage shared SOC services where budgets are tight; document the oversight model.

Deadlines, audits, and penalties in 2025

• National transpositions are in force across the EU; regulators are moving from awareness to enforcement.
• Expect document requests (policies, logs, risk registers) and on-site/remote inspections.
• Sanctions: up to €10M or 2% of global turnover for essential entities; up to €7M or 1.4% for important entities.
• Personal liability risk for management where negligence is shown.

One regulator told me privately: “We’re not hunting for perfect. We’re hunting for evidence that the board owns cybersecurity and that the plan works.” That means live runbooks, tested backups, patch SLAs, and provable guardrails for data and AI.

Quick compliance checklist you can paste into your tracker

• Board-approved cybersecurity policy and risk appetite
• Named NIS2 owner; executive training completed
• Asset inventory and business service mapping
• Risk assessment with treatment plan and residual risk sign-off
• MFA everywhere; PAM for admins; network segmentation
• Vulnerability management with defined SLAs and emergency patching
• Centralized logging, alerting, and retention policy
• Backup immutability and quarterly recovery tests
• Email and collaboration hardening; ICS attachment controls
• Vendor tiering, security clauses, and joint tabletop exercises
• 24h/72h/1-month incident reporting templates and contacts
• PII redaction and anonymization workflow for AI use
• Secure document upload process via a document reader

FAQ: NIS2 compliance questions leaders are asking

Who is in scope of NIS2?

Essential and important entities across critical sectors, including many digital service providers and managed service providers. If your disruption could impact public, economic, or societal functions, assume you’re in scope until proven otherwise.

How fast must we report incidents under NIS2?

Submit an early warning within 24 hours of becoming aware of a significant incident, an intermediate report within 72 hours, and a final report within one month.

How does NIS2 interact with GDPR?

If an incident involves personal data, GDPR’s 72-hour data breach notification to the DPA may also apply. Coordinate your DPO and CISO functions to avoid contradictory statements and missed deadlines.

Can staff use ChatGPT or other LLMs for work?

Only with guardrails. Prohibit sharing confidential or sensitive data. Use redaction/anonymization and a controlled upload process. When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.

What evidence do auditors typically request?

Policies, risk registers, asset lists, incident playbooks, vendor inventories, patch and backup reports, training records, and proof of tests (tabletops, restore drills). Expect to show how your NIS2 compliance checklist is implemented in practice.

Conclusion: make your NIS2 compliance checklist operational—and auditable

The difference between passing an inspection and scrambling under pressure is operational evidence. Turn your NIS2 compliance checklist into living practice: run the exercises, keep the logs, test the restores, and gate AI/document workflows behind protective tooling. Professionals across finance, health, and legal are cutting risk by using Cyrolo’s anonymizer and secure document reader. Try our secure document reader today — no sensitive data leaks.

As I heard from a CISO last week: “We stopped chasing perfection; we started proving control.” That mindset will carry you through 2025 audits—and beyond.