NIS2 checklist
NIS2 checklist for Sections 30 and 32 BSIG
Every minimum measure under Section 30 (2) BSIG and the reporting duties under Section 32 BSIG, each row with what an audit wants to see as evidence.
What the file contains
79 requirements, one row each with area, reference and what an audit wants to see as evidence. You fill in the columns for status, evidence, owner and due date.
- Section 30 (2) BSIG: minimum risk management measures 64 rows
- Section 32 BSIG: reporting duties for significant security incidents 15 rows
Template version 1.0-1f588a0c · content as of 12 November 2026 · Excel (XLSX) 107 KB · PDF 69 KB
This template exists in German and English; you get the English version.
This template is not legal advice. It does not replace checking which requirements apply to your company and does not guarantee any audit or certification result. License CC BY 4.0
How to use the file
Settle what applies
Check first whether and at which tier NIS2 applies to your company, for example with the free applicability check.
Enter status and evidence
For each row a status (open, partly, met, not applicable) and where the evidence is.
Assign the gaps
Open rows get an owner and a due date. That turns the list into a plan.
The portal takes it from there
In Complass the same requirements are the NIS2 catalog for Section 30 BSIG, with applicability, maturity level, evidence and owners. An incident gets the reporting channel under Section 32 BSIG with calculated deadlines.
Provate Complass con i vostri dati
Create voi stessi il vostro accesso di prova, se volete con un progetto di esempio per ogni quadro normativo. Se preferite vedere prima Complass, richiedete una demo.