Checklist · NIS2
NIS2 checklist: your external exposure in seven points
NIS2 prescribes no tool. It requires “appropriate and proportionate” measures and evidence. This checklist turns its articles 20, 21 and 23 into seven checks. NIS2 prescribes no tool. It requires “appropriate and proportionate” measures and evidence. This checklist turns its articles 20, 21 and 23 into seven checks on what your organisation exposes outside.
- Guide
- Checklist
- Steps
- 7 ·8 min read
- Published
- Last updated
In one sentence
The NIS2 directive expects essential and important entities to manage their risks, including those of their supply chain, and to notify significant incidents within 24 and then 72 hours: monitoring external exposure is one of the most direct ways to meet that.
Directive (EU) 2022/2555, known as NIS2, greatly widens the number of organisations subject to cybersecurity obligations and makes management accountable for implementing them. Its transposition in France is carried by the “resilience” law and ANSSI’s frameworks; check the state of the implementing texts on cyber.gouv.fr before freezing your programme.
The expected measures (article 21) include risk analysis, incident handling, supply-chain security, cyber hygiene and multi-factor authentication. None is limited to the inside of the information system: what your employees, suppliers and domains expose outside is part of it.
Steps
The seven checks
- 01
Determine whether you are in scope
Annexes I and II list the sectors (energy, transport, banking, health, digital, manufacturing of certain products, postal services, waste management, food…). The general threshold is that of medium-sized enterprises; some entities are in scope whatever their size. Classify yourself as “essential” or “important” and note the date of your obligations.
- 02
Inventory the external surface
Domains and subdomains, IP addresses and ranges, exposed services, certificates, SaaS applications used with work accounts, identities of key people. The inventory must be seen from the outside, because that is how an attacker sees it; what the internal inventory ignores stays exposed.
- 03
Monitor compromised credentials and devices
Use of valid credentials remains a preferred way in. Continuously monitor breaches and information-stealer logs tied to your domains, and handle each case under a written procedure (see our guide on compromised credentials). Document the time between detection and revocation.
- 04
Monitor the supply chain
NIS2 asks you to assess the security of your direct suppliers. At minimum: a list of critical suppliers, contractual notification clauses, and monitoring of their appearance on ransomware groups’ leak sites, so you trigger your own measures without waiting for their notification.
- 05
Organise incident notification
Article 23 provides for an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. Designate who reports, to whom (ANSSI in France), with what template, and test the chain at least once a year.
- 06
Formalise governance
Article 20 makes management bodies responsible for approving and overseeing the measures, and provides that they receive training. Put external exposure monitoring on a committee’s agenda, with an indicator tracked over time.
- 07
Build the evidence
An audit will ask what you monitor, since when, what you found and what you did about it. Keep the dated reports, the decisions and the handling times. A monthly posture report answers that request with no extra work.
What NIS2 concretely expects on external exposure
The text mentions neither “dark web” nor “external monitoring”. It speaks of risk management, supply-chain security, incident handling and basic hygiene. Auditors and national frameworks turn those requirements into controls; monitoring what circulates outside is a control that is easy to demonstrate, with dated evidence.
It answers in particular three questions every audit asks: do you know what you expose, did you know your credentials were circulating, and since when.
And DORA, for the financial sector?
Regulation (EU) 2022/2554, DORA, applies to financial entities since January 2025 and takes precedence over NIS2 for them. It requires ICT risk management, reporting of major incidents, resilience testing and oversight of third-party ICT providers. The seven checks above apply, with extra emphasis on providers.
Frequently asked questions
Does NIS2 require dark-web monitoring?
No, not in those terms. It requires proportionate risk management and evidence. External monitoring is a common, demonstrable way to cover risks tied to credentials, suppliers and the exposed surface.
Are we in scope as a subcontractor of an essential entity?
Not directly by the directive, unless your own sector and size place you there. However, your NIS2-bound customers must assess your security and will impose contractual requirements on you.
Where to start with a limited budget?
With the external inventory and monitoring of the credentials tied to your domains: they are the two controls with the best ratio between effort and risk covered, and the first ones you will be asked about.
Dated evidence, no extra work
An exposure assessment establishes your external inventory and the state of your circulating credentials, the starting point of a documented NIS2 programme.
Bespoke offering: one price per service, no public price, no packages.