Compliance & Regulation
GDPR Compliance Checklist: What Organizations Must Have in Place
GDPR is not new, but compliance gaps persist. A practical checklist of what controllers and processors must have in place — and be able to evidence.
Key takeaways
- NIS2 covers essential and important entities across many sectors.
- Member states had to transpose it by 17 October 2024; national laws vary.
- Incident reporting starts with an early warning within 24 hours.
- Management bodies must approve measures and can be held liable.
Scope
NIS2 (Directive (EU) 2022/2555) applies to medium and large entities in sectors such as energy, transport, banking, health, digital infrastructure, ICT service management, public administration, manufacturing and digital providers — classified as essential or important entities.
Risk management measures
Entities must implement appropriate measures including risk analysis policies, incident handling, business continuity, supply-chain security, secure development, vulnerability handling, cryptography, access control, MFA, training and effectiveness assessment.
Incident reporting
| Step | Timing |
|---|---|
| Early warning | Within 24 hours of becoming aware of a significant incident |
| Incident notification | Within 72 hours |
| Final report | Within one month |
Management accountability
Management bodies must approve cybersecurity risk measures, oversee implementation and undergo training. National laws can impose sanctions on individuals.
Preparing
- Determine whether and how you are in scope under the relevant national law.
- Register with the competent authority where required.
- Perform a gap assessment against required measures.
- Implement incident reporting procedures.
- Strengthen supply-chain security.
- Brief and train the management body.
Supply-chain security under NIS2
NIS2 explicitly requires entities to address security in relationships with direct suppliers and service providers, considering their vulnerabilities, product quality and secure development practices. Expect customers in scope to flow requirements down to you if you supply them.
Mapping NIS2 to existing frameworks
| NIS2 measure | Common evidence |
|---|---|
| Risk analysis and policies | ISO 27001 risk assessment and ISMS policies |
| Incident handling | IR plan, playbooks, exercise records |
| Business continuity | BCM plans, backup and DR tests |
| Supply-chain security | TPRM programme and contracts |
| Access control and MFA | IAM policies, MFA coverage reports |
| Training | Awareness programme records, management training |
How NAZZTEC helps
We determine scope under national transpositions, run gap assessments, build incident reporting procedures and map NIS2 measures to your existing ISO 27001 or NIST CSF controls so evidence is reused.
Next step: see our Governance, Risk & Compliance services.
Frequently asked questions
Does NIS2 apply outside the EU?
It can apply to non-EU entities providing certain services in the EU, and indirectly through supply-chain requirements.
Is ISO 27001 enough for NIS2?
It covers many measures and is strong evidence, but national requirements and reporting obligations must be addressed specifically.
What are the fines?
Fines for essential entities can reach the higher of EUR 10 million or 2% of global annual turnover; lower ceilings apply to important entities.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
