NIS2 & CSDDD Compliance Self-Assessment Checklist (European Union)

Your answers are saved on this device — never on our servers · Sign in

Fill in the details

0/136

0 of 136 completed

Type below - the document on the right updates as you go.

Entity name

Sector / principal activity

Org Size

Assessment date

Responsible officer

Nis2 Scope Entity Type Status

Nis2 Scope Entity Type Owner

Nis2 Scope Entity Type Evidence

Nis2 Scope Entity Type Target Date

Nis2 Scope Annex I Status

Nis2 Scope Annex I Owner

Nis2 Scope Annex I Evidence

Nis2 Scope Annex I Target Date

Nis2 Scope Annex Ii Status

Nis2 Scope Annex Ii Owner

Nis2 Scope Annex Ii Evidence

Nis2 Scope Annex Ii Target Date

Nis2 Scope Size Cap Status

Nis2 Scope Size Cap Owner

Nis2 Scope Size Cap Evidence

Nis2 Scope Size Cap Target Date

Nis2 Art21 Risk Analysis Status

Nis2 Art21 Risk Analysis Owner

Nis2 Art21 Risk Analysis Evidence

Nis2 Art21 Risk Analysis Target Date

Nis2 Art21 Incident Handling Status

Nis2 Art21 Incident Handling Owner

Nis2 Art21 Incident Handling Evidence

Nis2 Art21 Incident Handling Target Date

Nis2 Art21 Business Continuity Status

Nis2 Art21 Business Continuity Owner

Nis2 Art21 Business Continuity Evidence

Nis2 Art21 Business Continuity Target Date

Nis2 Art21 Supply Chain Status

Nis2 Art21 Supply Chain Owner

Nis2 Art21 Supply Chain Evidence

Nis2 Art21 Supply Chain Target Date

Nis2 Art21 Vulnerability Handling Status

Nis2 Art21 Vulnerability Handling Owner

Nis2 Art21 Vulnerability Handling Evidence

Nis2 Art21 Vulnerability Handling Target Date

Nis2 Art21 Effectiveness Assessment Status

Nis2 Art21 Effectiveness Assessment Owner

Nis2 Art21 Effectiveness Assessment Evidence

Nis2 Art21 Effectiveness Assessment Target Date

Nis2 Art21 Cyber Hygiene Status

Nis2 Art21 Cyber Hygiene Owner

Nis2 Art21 Cyber Hygiene Evidence

Nis2 Art21 Cyber Hygiene Target Date

Nis2 Art21 Cryptography Status

Nis2 Art21 Cryptography Owner

Nis2 Art21 Cryptography Evidence

Nis2 Art21 Cryptography Target Date

Nis2 Art21 Hr Security Status

Nis2 Art21 Hr Security Owner

Nis2 Art21 Hr Security Evidence

Nis2 Art21 Hr Security Target Date

Nis2 Art21 Mfa Status

Nis2 Art21 Mfa Owner

Nis2 Art21 Mfa Evidence

Nis2 Art21 Mfa Target Date

Nis2 Art23 Early Warning 24h Status

Nis2 Art23 Early Warning 24h Owner

Nis2 Art23 Early Warning 24h Evidence

Nis2 Art23 Early Warning 24h Target Date

Nis2 Art23 Notification 72h Status

Nis2 Art23 Notification 72h Owner

Nis2 Art23 Notification 72h Evidence

Nis2 Art23 Notification 72h Target Date

Nis2 Art23 Final Report 1m Status

Nis2 Art23 Final Report 1m Owner

Nis2 Art23 Final Report 1m Evidence

Nis2 Art23 Final Report 1m Target Date

Nis2 Art23 Notify Recipients Status

Nis2 Art23 Notify Recipients Owner

Nis2 Art23 Notify Recipients Evidence

Nis2 Art23 Notify Recipients Target Date

Nis2 Art20 Approval Status

Nis2 Art20 Approval Owner

Nis2 Art20 Approval Evidence

Nis2 Art20 Approval Target Date

Nis2 Art20 Oversight Status

Nis2 Art20 Oversight Owner

Nis2 Art20 Oversight Evidence

Nis2 Art20 Oversight Target Date

Nis2 Art20 Training Status

Nis2 Art20 Training Owner

Nis2 Art20 Training Evidence

Nis2 Art20 Training Target Date

Nis2 Registration Status

Nis2 Registration Owner

Nis2 Registration Evidence

Nis2 Registration Target Date

Nis2 Registration Update Status

Nis2 Registration Update Owner

Nis2 Registration Update Evidence

Nis2 Registration Update Target Date

Csddd Scope Thresholds Status

Csddd Scope Thresholds Owner

Csddd Scope Thresholds Evidence

Csddd Scope Thresholds Target Date

Csddd Integrate Policies Status

Csddd Integrate Policies Owner

Csddd Integrate Policies Evidence

Csddd Integrate Policies Target Date

Csddd Identify Impacts Status

Csddd Identify Impacts Owner

Csddd Identify Impacts Evidence

Csddd Identify Impacts Target Date

Csddd Prevent Mitigate Status

Csddd Prevent Mitigate Owner

Csddd Prevent Mitigate Evidence

Csddd Prevent Mitigate Target Date

Csddd Bring To End Status

Csddd Bring To End Owner

Csddd Bring To End Evidence

Csddd Bring To End Target Date

Csddd Complaints Mechanism Status

Csddd Complaints Mechanism Owner

Csddd Complaints Mechanism Evidence

Csddd Complaints Mechanism Target Date

Csddd Monitor Effectiveness Status

Csddd Monitor Effectiveness Owner

Csddd Monitor Effectiveness Evidence

Csddd Monitor Effectiveness Target Date

Csddd Public Communication Status

Csddd Public Communication Owner

Csddd Public Communication Evidence

Csddd Public Communication Target Date

Csddd Climate Transition Plan Status

Csddd Climate Transition Plan Owner

Csddd Climate Transition Plan Evidence

Csddd Climate Transition Plan Target Date

Overall compliance status

Reviewer

Next review date

The clauses below are blurred in the preview. Fill in your details, then pay once to unlock the full document and download it as Word & PDF.

Proceed to payment →

🔒 Secure & private · ⚡ Instant download after payment · One-time payment · no subscription

NIS2 & CSDDD Compliance Self-Assessment Checklist

NIS2 & CSDDD COMPLIANCE SELF-ASSESSMENT CHECKLIST

Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua ut enim ad minim veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat duis aute irure dolor in reprehenderit voluptate velit esse cillum dolore eu fugiat nulla pariatur lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut.

ORGANISATION IDENTITY

Entity name: ________
Sector / principal activity: ________
Organisation size (headcount / turnover / balance sheet): ________
Assessment date: ________
Responsible officer: ________

PART 1 — NIS2 DIRECTIVE (EU) 2022/2555

Scope determination

Requirement	Status	Owner	Evidence	Target date
Determine whether the entity is an "essential entity" or an "important entity"	________	________	________	________
Confirm which sector(s) in Annex I (sectors of high criticality) apply	________	________	________	________
Confirm which sector(s) in Annex II (other critical sectors) apply	________	________	________	________
Verify size-cap thresholds and any size-cap exemptions	________	________	________	________

Cybersecurity risk-management measures (Art. 21)

Requirement	Status	Owner	Evidence	Target date
Policies on risk analysis and information system security	________	________	________	________
Incident handling	________	________	________	________
Business continuity, backup management and disaster recovery, and crisis management	________	________	________	________
Supply-chain security, including security aspects with direct suppliers and service providers	________	________	________	________
Security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure	________	________	________	________
Policies and procedures to assess the effectiveness of risk-management measures	________	________	________	________
Basic cyber hygiene practices and cybersecurity training	________	________	________	________
Policies and procedures on the use of cryptography and, where appropriate, encryption	________	________	________	________
Human resources security, access control policies and asset management	________	________	________	________
Use of multi-factor authentication (MFA) or continuous authentication and secured communications	________	________	________	________

Incident reporting obligations (Art. 23)

Requirement	Status	Owner	Evidence	Target date
Process to submit an early warning to the CSIRT / competent authority within 24 hours of becoming aware of a significant incident	________	________	________	________
Process to submit an incident notification within 72 hours	________	________	________	________
Process to submit a final report no later than one month after the incident notification	________	________	________	________
Process to notify recipients of services of significant incidents, where appropriate	________	________	________	________

Governance and management-body accountability (Art. 20)

Requirement	Status	Owner	Evidence	Target date
Management body approves the cybersecurity risk-management measures	________	________	________	________
Management body oversees implementation of the measures	________	________	________	________
Management-body members follow cybersecurity training	________	________	________	________

Registration with the competent authority

Requirement	Status	Owner	Evidence	Target date
Register the entity and submit required information to the competent authority	________	________	________	________
Keep registration details (contacts, IP ranges, Member States of operation) up to date	________	________	________	________

PART 2 — CORPORATE SUSTAINABILITY DUE DILIGENCE DIRECTIVE (EU) 2024/1760

Scope and integration

Requirement	Status	Owner	Evidence	Target date
Determine whether the company meets the employee and net-turnover thresholds bringing it within scope	________	________	________	________
Integrate due diligence into policies and risk-management systems, including a due diligence policy	________	________	________	________

Risk-based due diligence process (Arts. 5–16)

Requirement	Status	Owner	Evidence	Target date
Identify and assess actual and potential adverse human-rights and environmental impacts in own operations, subsidiaries and the chain of activities	________	________	________	________
Prevent and mitigate potential adverse impacts	________	________	________	________
Bring actual adverse impacts to an end and minimise their extent	________	________	________	________
Establish and maintain a complaints / notification mechanism	________	________	________	________
Monitor the effectiveness of the due diligence policy and measures (periodic assessment)	________	________	________	________
Publicly communicate on due diligence (annual statement)	________	________	________	________
Adopt and put into effect a climate-change transition plan compatible with limiting global warming to 1.5°C	________	________	________	________

SUMMARY & SIGN-OFF

Overall compliance status: ________
Reviewer: ________
Next review date: ________

Fields you complete are inserted into the document live. This template is general guidance only - not legal advice.