NIS2 Compliance Checklist for 2026

In Hungary, the NIS2 Directive is transposed by Act XXIII of 2023 on cybersecurity certification and supervision, with implementation details set out in Ministerial Decree 7/2024 (VI. 24.). Most deadlines have passed, and the supervisory authority (SZTFH) has begun inspections. This checklist walks through the actual obligations, not in theory, but in the order they come up in a real project.

1. Determine whether you are in scope

This is the first step and the one most often got wrong. It requires assessing two things together:

Sector. The law lists affected sectors in two annexes. Annex I covers highly critical sectors (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space). Annex II covers other critical sectors (postal services, waste management, chemicals, food, manufacturing (including medical devices, computers, electronics, machinery, vehicles), digital providers, research).

Size. By default the medium-enterprise threshold applies: at least 50 employees, or annual turnover and balance sheet total exceeding EUR 10 million.

The practical pitfall: you can fall in scope below the size threshold if you are the sole provider of a given activity, if disruption of your service would significantly affect public safety, or if you are a public administration body. Start the analysis with the sector, not the headcount.

2. Register with the supervisory authority

Entities in scope must register and report their contact details, sector classification and IP ranges. Registration is not a formality: it is the basis on which the authority will reach you with a vulnerability alert or an inspection.

Also appoint a cybersecurity contact person. This role owns communication with the authority and incident notifications, it should not be a generic info@ mailbox.

3. Implement the ten mandatory measures

The law prescribes ten measure areas. Each carries a documentation obligation, doing it is not enough, you must be able to evidence it.

In practice, organisations get stuck on item 4 (supply chain), item 6 (effectiveness measurement) and item 9 (asset inventory). Inventory is particularly painful in OT environments: in many plants nobody knows exactly how many PLCs and engineering workstations sit on the network.

4. Know the incident reporting deadlines

Reporting is a three-stage process with strict deadlines:

1. Within 24 hours, early warning. It is enough to state that a significant incident is suspected, whether it appears to be caused by unlawful acts, and whether cross-border impact is possible.
2. Within 72 hours, incident notification. Initial assessment, severity, impact and, where available, indicators of compromise.
3. Within one month, final report. Detailed description, root cause, measures applied and planned, cross-border impact.

If the incident is ongoing, a progress report is due after one month, with the final report within one month of closure.

An incident is "significant" if it causes severe operational disruption or financial loss, or if it is capable of causing considerable material or non-material damage to other natural or legal persons. Define and document this threshold in advance, mid-incident is not the time to debate whether something is reportable.

5. Account for management liability

This is one of the biggest changes NIS2 brings. The management body of the entity:

• approves the cybersecurity measures,
• oversees their implementation,
• is liable for failures to comply,
• must attend regular training and ensure comparable training for staff.

Liability therefore cannot be delegated to the IT manager. Approval and management training must be documented, this is among the first things an inspection will ask for.

6. Map evidence to each measure

Compliance is a question of demonstrability. Every measure should have:

• the policy or procedure, signed and in force,
• evidence of operation (logs, minutes, test reports, training attendance records),
• a named owner and a review frequency.

If you already hold ISO 27001 certification, much of the work is done: the Annex A controls overlap heavily with the ten measures. NIS2 goes further in several respects, however, specifically on incident reporting deadlines, management liability and the rigour of supply chain requirements.

7. Do not forget the OT environment

If your sector is manufacturing, energy, water or transport, scope extends to industrial control systems. Much of the standard IT toolkit does not apply here: PLCs cannot be patched on a schedule, network agents often cannot be installed, and downtime costs real money.

On the OT side, NIS2 is best delivered along the IEC 62443 family of standards, the zone-and-conduit model, security level determination and passive asset discovery are a language both plant engineers and auditors understand. We covered this in more depth on our OT/ICS security page.

What to do now

If you have not started, work in this order:

1. Scope analysis, in writing, with reasoning. If you are out of scope, document that too.
2. Gap analysis against the ten measures, with weighted risk ratings.
3. Roadmap with owners and deadlines, approved by the management body.
4. Quick wins first: MFA, asset inventory, incident reporting template, management training.
5. Measurement and review, measure 6 makes this an obligation in itself.

The most common mistake is treating NIS2 as a document-production exercise. The authority looks at operation: is there tested restoration, is there a real asset inventory, has management been trained. Paper alone protects you from neither the attack nor the fine.

If you want to assess where you stand, our NIS2 service starts with a structured gap analysis and ends with a concrete, prioritised action plan.