NIS2 checklist
NIS2 checklist for Sections 30 and 32 BSIG
Every minimum measure under Section 30 (2) BSIG and the reporting duties under Section 32 BSIG, each row with what an audit wants to see as evidence.
What the file contains
79 requirements, one row each with area, reference and what an audit wants to see as evidence. You fill in the columns for status, evidence, owner and due date.
- Section 30 (2) BSIG: minimum risk management measures 64 rows
- Section 32 BSIG: reporting duties for significant security incidents 15 rows
Template version 1.0-1f588a0c · content as of 12 November 2026 · Excel (XLSX) 107 KB · PDF 69 KB
This template is not legal advice. It does not replace checking which requirements apply to your company and does not guarantee any audit or certification result. License CC BY 4.0
How to use the file
Settle what applies
Check first whether and at which tier NIS2 applies to your company, for example with the free applicability check.
Enter status and evidence
For each row a status (open, partly, met, not applicable) and where the evidence is.
Assign the gaps
Open rows get an owner and a due date. That turns the list into a plan.
The portal takes it from there
In Complass the same requirements are the NIS2 catalog for Section 30 BSIG, with applicability, maturity level, evidence and owners. An incident gets the reporting channel under Section 32 BSIG with calculated deadlines.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.