I start with a written scope decision, an owner for every gap, and evidence that the controls actually work. I do not treat a completed template as a compliance certificate.
I use this as a practical starting point, not a legal determination or guarantee of compliance. I verify the current rules with the competent authority for the entity and sector.
Before I start
- Your legal entities, activities, locations, size/group structure, and relevant sector regulator.
- A management sponsor, security owner, legal contact, and incident-response contact.
- An existing asset/service inventory and a secure evidence location.
Step by step
Determine the applicable scope
The Danish general NIS2 law took effect on 1 July 2025. Scope depends on sector, entity characteristics, size rules and exceptions; some sectors use separate legislation. I document the basis and have the applicable authority or qualified adviser resolve uncertainty.
Record the authority and registration route
I identify the competent sector authority, registration requirements, and incident reporting channel. I record contacts and access arrangements before an incident. I do not reuse another company’s scope conclusion without checking our own facts.
Put management decisions on record
I prepare a short risk summary and ask management to approve priorities, resources, and accountable owners. I schedule appropriate management training and retain the agenda, attendance, and decisions.
Map critical services and suppliers
I list services, owners, dependencies, recovery objectives, suppliers, and the impact of loss. I use the risk register to score likelihood and impact, document existing controls, and assign each treatment a due date.
Build the control evidence register
I map applicable measures to risk management, incident handling, continuity/recovery, supply-chain security, secure development/vulnerability handling, effectiveness reviews, cyber hygiene/training, cryptography, access/asset controls, and appropriate strong authentication/communications. Each row gets an owner, evidence location, and test date.
Exercise the incident timeline
For a significant incident under the general Danish law, prepare early warning within 24 hours of awareness and notification within 72 hours; the final report is normally due within one month after notification. Ongoing incidents require the applicable progress/final-report process. I confirm sector-specific rules and practise handoff to the authorised reporter.
Test controls instead of collecting policies only
I sample privileged-access reviews, patch completion, supplier checks, and a restore. I record result, gap, and remediation owner. I store sensitive evidence in our controlled repository, not on this public website.
Review progress with management
I report overdue risks, tested controls, significant changes, and required decisions monthly. I reassess scope after acquisitions or service changes and retain the history of why decisions were made.
How I check the result
0 of 4 checks completed
Checklist progress stays in this browser. I use it to track checks, not to certify a deployment or compliance.
If something does not work
Unsure whether we are in scope
Use the authority’s scope guidance and seek a documented determination.
Evidence has no owner
Assign a control owner and test date before marking the row implemented.
24/72-hour process is unclear
Run a tabletop exercise, capture awareness time, and verify the reporting route with the competent authority.
My working templates
I map applicable measures to accountable owners, actual tests, and remediation.
Download CSV ↓I record likelihood and impact separately, then assign a treatment and acceptance owner.
Download CSV ↓I capture the incident clock, ownership, impact, communications, and regulatory decisions.
Download MD ↓I connect supplier obligations, dependencies, access, evidence, and renewal decisions.
Download CSV ↓Official sources I checked
I checked these sources on 13 October 2026. Product screens and legal requirements change; I verify the relevant source before a production rollout or legal decision.