Notification Readiness Checklist

Confirms portal access, authority contacts, delegated signatories and templates are ready before an incident.

Available soon

Format: Excel
Size: 73 KB
Length: 13 sheets
Version: 1.0
Updated: 2 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.02 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	When: at least every [[6]] months, and at once whenever an authority, a channel, a signatory or the applicability profile changes (RN-17).
2	Who: the Head of Information Security owns this checklist ([[e.g. Head of Information Security or CISO]]). Each check has an owner, the person who keeps it true and holds its evidence. The Head of Information Security gathers the answers, completes the result and signs it off.
3	Result: enter the date of this check and confirm the intervals under 'Your settings'. Every due date in the workbook counts from them.
4	Authorities and Channels: fill one row for each authority in your applicability profile, and for the other notices P09 lists (customers under contract, the cyber insurer, the police). Checks RC-04 to RC-06 are judged against this sheet. Ring the out-of-hours number: a number on a website is not a tested contact.
5	Signatories: one row for each person who may submit through each channel, a primary and a deputy at least. Test access by signing in to the portal, not by confirming that an account exists. Record the date of the test. Checks RC-07 and RC-08 are judged against this sheet.
6	Checklist: for each check, look at the evidence and choose a status from the list: Ready, Partly ready, Not ready, Not applicable. Write where the evidence is, and a note for any status short of Ready. Name the owner and the date checked. The next check date calculates.
7	Gap Actions: for every check that is Partly ready or Not ready, add an action with one owner and a due date. The Check column on the Checklist prompts until each gap has an action.
8	Read the Result: the readiness result, the counts by area, and the Readiness measure (RNM-04). A blocking check that is Not ready makes the whole result Not ready: fix it before anything else, and re-check as soon as it is fixed.
9	Sign off the result, and report the Readiness measure to executive management with the other headline measures every quarter (RN-18). Copy it into the Regulatory Notification Log's measures.
10	Add checks of your own on the blank rows at the foot of the Checklist, for example a duty your national law adds. Give each an ID in the same form (RC-19 onwards) and an area from the list. They count in the result.
11	To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on the Checklist, Authorities and Channels, Signatories and Gap Actions sheets. The checks stay. The EXAMPLE Checks sheet is reference: keep it or delete it.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

RN-17: The Notification Readiness Checklist must be completed at least every [[6]] months and whenever an authority, channel, signatory or the profile changes. Each signatory's access to each channel is tested at least every [[12]] months, and every signatory has a deputy with access.

RN-08: Each report must be approved by the approver P09 names for its template, and submitted only by a notification signatory through the authority's channel. Where at least [[60]] minutes remain before the deadline, a second person checks it against the fact base first.

Status words. Ready: the evidence shows the check is met today. Partly ready: some of it is met, or met for some authorities or channels but not all. Not ready: it is not met, or there is no evidence. Not applicable: it cannot apply to you, with the reason in the note.

The result. Not ready: any blocking check is Not ready. Ready with gaps: no blocking check is Not ready, but at least one check is Partly ready, Not ready or not yet checked. Ready: every check is Ready or Not applicable.

Blocking checks: RC-01, RC-04, RC-07, RC-08, RC-09, RC-12. Without any one of them a report cannot be made on time, whatever else is in place. A blocking check that is Partly ready gives Ready with gaps, not Not ready: fix it next.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. It adopted this pack on 15 Sep 2026 and made its first check on 18 Sep 2026. RC-08 was Not ready: the deputy for the NIS2 portal had no account. The result was Not ready. The account was issued and tested on 24 Sep 2026, and the re-check on 25 Sep 2026 gave Ready with gaps: three checks are still Partly ready, each with an open action. The Checklist shows the state after the re-check; the EXAMPLE Checks sheet shows both.

National details are placeholders. The authority, its portal, address, numbers, language and forms come from [[national law transposing NIS2: title, number and date]] and the authority's own website. Confirm them with counsel and the authority before you rely on them.

Tailoring — small organisation: keep every blocking check. One person may own several checks, but every channel still needs a deputy with tested access (RN-17).

Tailoring — financial entity under DORA: RC-16 applies if a third party reports for you; tell the authority before the first notification (Implementing Regulation (EU) 2025/302, Article 6). Record the authority's secure channel and the other secure means agreed with it for when the channel fails (Article 4). The initial notification can fall due 4 hours after classification, so the decider and a signatory must be reachable at any hour.

Tailoring — processor for other controllers: RC-15 applies. Record each controller's breach contact and the notice period its contract sets; RN-15 allows no more than [[24]] hours from awareness.

Tailoring — group of companies: each legal entity with its own duty needs its own row on the Authorities and Signatories sheets. One group team can do the work, but each entity's profile, signatories and access are checked for that entity.

This workbook is your own record. Keep it with the applicability profile and the log, and keep each signed-off copy.

Checklist

The 18 checks, by area. Yellow columns are yours; the next check date and the Check column calculate. A blocking check that is Not ready makes the result Not ready.

Row	Check ID	Area	Check	Blocking	Rule	Status	Evidence, and where it is kept	Note (for any status short of Ready)	Owner	Checked on	Next check due	Check
EXAMPLE	RC-01	Applicability	The applicability profile is approved and was reviewed in the last 12 months	Yes	RN-01	Ready	Applicability profile approved by executive management on 15 Sep 2026, with the pack		Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-02	Applicability	The NIS2 classification is confirmed in writing (P12) and the registration details held by the authority are current	No	P12 NR-02	Ready	NIS2 scope assessment confirmed by the board on 21 May 2026 (P12, row ST-13); registration details [[checked on the national register on 18 Sep 2026]]		Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-03	Applicability	Any shorter national clock or extra report is entered in the profile	No	RN-01	Ready	Applicability profile, national clocks: [[no shorter clock in national law, confirmed by counsel]]		Legal	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-04	Authorities and channels	Each authority in the profile is named, with its channel, address and telephone number	Yes	RN-01	Ready	Authorities and Channels sheet: the NIS2 and GDPR rows		Incident manager	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-05	Authorities and channels	Each authority's out-of-hours contact is known and was checked in the last 12 months	No	RN-17	Partly ready	Authorities and Channels sheet: the out-of-hours column	The supervisory authority's out-of-hours line is not published; asked in writing on 18 Sep, no reply yet.	Data Protection Officer	18 Sep 2026	18 Mar 2027	Gap action open
EXAMPLE	RC-06	Authorities and channels	Language and format each authority accepts are recorded, including any form it requires	No	RN-07	Ready	Authorities and Channels sheet: the language and form columns		Incident manager	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-07	People and authority	Every signatory is named in writing, with a deputy, for each channel	Yes	RN-08	Ready	Signatories sheet: a primary and a deputy for each channel, named in the applicability profile		Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-08	People and authority	Every signatory and deputy has working access to each channel, tested in the last 12 months, with sign-in that does not depend on one person's device	Yes	RN-17	Ready	Signatories sheet: every access tested on 18 Sep 2026; the NIS2 deputy's on 24 Sep 2026 (RA-01)	The GDPR channel's deputy (Legal) has access; the NIS2 portal's deputy (Head of Information Security) had none. Account issued and tested on 24 Sep.	Information Security Manager	25 Sep 2026	25 Mar 2027	OK
EXAMPLE	RC-09	People and authority	The decider and the template approvers each have a named deputy, reachable out of hours	Yes	RN-06	Ready	Incident Response Plan (P09): deputies named for the executive incident lead and each template approver, with out-of-hours numbers		Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-10	People and authority	Legal's out-of-hours contact is known, and Legal has agreed the review time limit	No	RN-07	Partly ready	Legal's written agreement to the review time limit, working hours only	Legal agreed the 60-minute review limit for working hours only; out-of-hours cover to be agreed with external counsel.	Legal	18 Sep 2026	18 Mar 2027	Gap action open
EXAMPLE	RC-11	Templates and facts	The NIS2 and personal data breach templates are current, with the entity's details already filled in	No	RN-07	Ready	NIS2 Early Warning, Notification & Final Report Templates and Personal Data Breach Notification Templates, with the entity's details filled in		Incident manager	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-12	Templates and facts	The fact base form and the log are set up and reachable during an outage of the main systems	Yes	RN-11	Ready	Fact base form and Regulatory Notification Log held [[on the out-of-band incident site]]; opened from a spare laptop on 18 Sep 2026		Incident manager	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-13	Templates and facts	Templates for notices to customers and individuals are approved in advance (P09 CT-04, CT-08)	No	RN-14	Ready	P09 templates CT-04 and CT-08, approved as P09 names		Communications lead	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-14	Suppliers and processors	Contracts with suppliers that hold our data or run our services carry the incident notification clause, with notice within [[24]] hours (P06 CL-07)	No	RN-15	Ready	Supplier contract register (P06): clause CL-07 in each contract with a supplier that holds our data or runs our services		Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-15	Suppliers and processors	Where we act as a processor, each controller's breach contact and contractual notice period is recorded	No	RN-15	Not applicable	Applicability profile: GDPR role	Not a processor for any other controller (profile).	Data Protection Officer	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-16	Suppliers and processors	Where a third party submits DORA reports for us, the contract and its access are in place	No	RN-16	Not applicable	Applicability profile: DORA row	DORA does not apply (profile).	Head of Information Security	18 Sep 2026	18 Mar 2027	OK
EXAMPLE	RC-17	Practice and records	Notification decisions and a report were rehearsed in an exercise in the last 12 months (P10)	No	RN-17	Partly ready	P10 exercise programme: the tabletop of 18 Mar 2026 held; the tabletop of 22 Oct 2026 planned	The tabletop of 18 Mar 2026 did not rehearse a report. The tabletop of 22 Oct 2026 will include a NIS2 early warning inject.	Head of Information Security	18 Sep 2026	18 Mar 2027	Gap action open
EXAMPLE	RC-18	Practice and records	The log holds every decision and report since the last check, with references	No	RN-09	Ready	Regulatory Notification Log: 17 decisions and 4 submissions of Q3 2026, entered on adoption		Incident manager	18 Sep 2026	18 Mar 2027	OK

Result

Result and sign-off

The readiness result, the counts by area and the Readiness measure, worked out from the Checklist. Only 'Your settings' and the sign-off are yours; everything else calculates.

EXAMPLE: the example organisation's checklist after its re-check of 2026-09-25. Clear the EXAMPLE answers to use your own.

Your settings

Setting	Value	What it does
Date of this check	25 Sep 2026	Signatory tests, authority details and gap actions are judged as at this date. Type it; never a formula that changes it.
Readiness interval (months)	6	RN-17: the checklist is completed at least this often. Each check's next date counts from it.
Access test interval (months)	12	RN-17: each signatory's access to each channel is tested at least this often.
Look-back for contact details (months)	12	The checks' own look-back ("in the last 12 months"): authority details older than this are checked again.

Result

Measure	Result	How it is worked out
Readiness result	Ready with gaps	Not ready: a blocking check is Not ready. Ready with gaps: none is, but a check is short of Ready or not checked. Ready: every check is Ready or Not applicable.
Readiness (RNM-04): checks Ready	13 of 16	Ready checks, out of all checks less those Not applicable. Readiness checks Ready, out of those that apply, at the last check; and blocking checks not Ready.
Readiness (RNM-04): blocking checks not Ready	0	Target: Every blocking check Ready. Any blocking check Partly ready or Not ready counts.
Next full check due	18 Mar 2027	The earliest next check date on the Checklist: the interval after the oldest check.

Checks by area

Area	Checks	Blocking	Ready	Partly ready	Not applicable
Applicability	3	1	3	0	0
Authorities and channels	3	1	2	1	0
People and authority	4	3	3	1	0
Templates and facts	3	1	3	0	0
Suppliers and processors	3	0	1	0	2
Practice and records	2	0	1	1	0
All areas	18	6	13	3	2

Checks without a Check ID are not counted. A check in an area not on the list is counted in no area: use the Area list.

Sign-off

Role	Name	Date	Signature or reference
Checked by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Result accepted by (Executive incident lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reported to (Executive management)	[[Meeting]]	[[YYYY-MM-DD]]	[[Minute reference]]
Next check due	[[Within 6 months, or at once on a change (RN-17)]]	[[YYYY-MM-DD]]

Authorities and Channels

Who receives each report, and how to reach them at any hour (RC-04 to RC-06). One row per authority in the applicability profile, then the other notices P09 lists. Placeholders are national details to confirm.

Row	Regime or notice	Applies to us	Authority or recipient	Channel or portal	Address (web or email)	Telephone	Out of hours	Language accepted	Form required	Last checked	Note	Check
EXAMPLE	NIS2	Yes	[[national CSIRT, or the competent authority where notifications go to it]]	[[the national notification portal or address, from the national law or the CSIRT's website]]	[[web address of the portal, or the email address for reports]]	[[switchboard or incident line]]	[[the authority's 24-hour line]]	[[official language(s); whether English is accepted]]	[[the authority's form for the early warning, notification and final report, or none]]	18 Sep 2026	National clocks: [[no shorter clock in national law, confirmed by counsel]]	OK
EXAMPLE	DORA	No	—	—	—	—	—	—	—	18 Sep 2026	Not a financial entity: DORA does not apply (applicability profile).	Not applicable
EXAMPLE	GDPR	Yes	[[lead supervisory authority, or the supervisory authority of the Member State concerned]]	[[the authority's breach notification form or portal]]	[[web address of the portal, or the email address for reports]]	[[switchboard or incident line]]	The supervisory authority's out-of-hours line is not published; asked in writing on 18 Sep, no reply yet.	[[official language(s); whether English is accepted]]	[[the authority's breach notification form or portal]]	18 Sep 2026		OK
EXAMPLE	Contract	Yes	[[customers with a notification clause]]	[[how the notice is given]]	[[address]]	[[telephone]]	[[out-of-hours line, or none]]	—	—	18 Sep 2026	P09 RD-14: notice to customers under contract, [[as each contract requires]].	OK
EXAMPLE	Insurance	Yes	[[insurer or broker incident line]]	[[how the notice is given]]	[[address]]	[[telephone]]	[[out-of-hours line, or none]]	—	—	18 Sep 2026	P09 RD-15: notice to the cyber insurer, [[as the policy requires, often within 48 hours]].	OK
EXAMPLE	Law enforcement	Yes	[[national cybercrime reporting service]]	[[how the notice is given]]	[[address]]	[[telephone]]	[[out-of-hours line, or none]]	—	—	18 Sep 2026	P09 RD-16: crime report, [[as soon as practical for suspected crime]].	OK

Signatories

Who may submit through each channel (RN-08), and when each one's access was last tested (RN-17). A primary and a deputy for every channel; test by signing in.

Row	Channel	Channel or portal	Role	Signatory	Access tested on	Next test due	Test	Channel has a deputy	Note
EXAMPLE	NIS2	[[the national notification portal or address, from the national law or the CSIRT's website]]	Primary	Information Security Manager	18 Sep 2026	18 Sep 2027	In date	Yes
EXAMPLE	NIS2	[[the national notification portal or address, from the national law or the CSIRT's website]]	Deputy	Head of Information Security	24 Sep 2026	24 Sep 2027	In date	Yes	No account at the first check (18 Sep 2026). Issued and tested on 24 Sep 2026 (RA-01).
EXAMPLE	GDPR	[[the authority's breach notification form or portal]]	Primary	Data Protection Officer	18 Sep 2026	18 Sep 2027	In date	Yes
EXAMPLE	GDPR	[[the authority's breach notification form or portal]]	Deputy	Legal	18 Sep 2026	18 Sep 2027	In date	Yes

Gap Actions

One action for each check short of Ready, with one owner and a due date. A blocking check's action comes first.

Row	Action ID	Check ID	Check status now	Action	Owner	Due	Status	Done on	Check
EXAMPLE	RA-01	RC-08	Ready	Issue and test a NIS2 portal account for the Head of Information Security	Information Security Manager	30 Sep 2026	Done	24 Sep 2026	Closed
EXAMPLE	RA-02	RC-05	Partly ready	Obtain the supervisory authority's out-of-hours contact, or record that it has none	Data Protection Officer	16 Oct 2026	Open		Open, in time
EXAMPLE	RA-03	RC-10	Partly ready	Agree out-of-hours review cover with external counsel	Legal	31 Oct 2026	Open		Open, in time
EXAMPLE	RA-04	RC-17	Partly ready	Add a NIS2 early warning inject to the tabletop of 22 Oct 2026	Head of Information Security	22 Oct 2026	Open		Open, in time

EXAMPLE Checks

EXAMPLE: the first check and the re-check

The distributor's first check under the pack, on 18 Sep 2026, and its re-check a week later, on 25 Sep 2026, both by the Head of Information Security. Each result is worked out by the same rule as the Result sheet.

Check ID	Area	Check	Blocking	2026-09-18	2026-09-25	Note
RC-01	Applicability	The applicability profile is approved and was reviewed in the last 12 months	Yes	Ready	Ready
RC-02	Applicability	The NIS2 classification is confirmed in writing (P12) and the registration details held by the authority are current	No	Ready	Ready
RC-03	Applicability	Any shorter national clock or extra report is entered in the profile	No	Ready	Ready
RC-04	Authorities and channels	Each authority in the profile is named, with its channel, address and telephone number	Yes	Ready	Ready
RC-05	Authorities and channels	Each authority's out-of-hours contact is known and was checked in the last 12 months	No	Partly ready	Partly ready	The supervisory authority's out-of-hours line is not published; asked in writing on 18 Sep, no reply yet. Action RA-02, due 16 Oct 2026.
RC-06	Authorities and channels	Language and format each authority accepts are recorded, including any form it requires	No	Ready	Ready
RC-07	People and authority	Every signatory is named in writing, with a deputy, for each channel	Yes	Ready	Ready
RC-08	People and authority	Every signatory and deputy has working access to each channel, tested in the last 12 months, with sign-in that does not depend on one person's device	Yes	Not ready	Ready	The GDPR channel's deputy (Legal) has access; the NIS2 portal's deputy (Head of Information Security) had none. Account issued and tested on 24 Sep. Action RA-01, due 30 Sep 2026, done 24 Sep 2026.
RC-09	People and authority	The decider and the template approvers each have a named deputy, reachable out of hours	Yes	Ready	Ready
RC-10	People and authority	Legal's out-of-hours contact is known, and Legal has agreed the review time limit	No	Partly ready	Partly ready	Legal agreed the 60-minute review limit for working hours only; out-of-hours cover to be agreed with external counsel. Action RA-03, due 31 Oct 2026.
RC-11	Templates and facts	The NIS2 and personal data breach templates are current, with the entity's details already filled in	No	Ready	Ready
RC-12	Templates and facts	The fact base form and the log are set up and reachable during an outage of the main systems	Yes	Ready	Ready
RC-13	Templates and facts	Templates for notices to customers and individuals are approved in advance (P09 CT-04, CT-08)	No	Ready	Ready
RC-14	Suppliers and processors	Contracts with suppliers that hold our data or run our services carry the incident notification clause, with notice within [[24]] hours (P06 CL-07)	No	Ready	Ready
RC-15	Suppliers and processors	Where we act as a processor, each controller's breach contact and contractual notice period is recorded	No	Not applicable	Not applicable	Not a processor for any other controller (profile).
RC-16	Suppliers and processors	Where a third party submits DORA reports for us, the contract and its access are in place	No	Not applicable	Not applicable	DORA does not apply (profile).
RC-17	Practice and records	Notification decisions and a report were rehearsed in an exercise in the last 12 months (P10)	No	Partly ready	Partly ready	The tabletop of 18 Mar 2026 did not rehearse a report. The tabletop of 22 Oct 2026 will include a NIS2 early warning inject. Action RA-04, due 22 Oct 2026.
RC-18	Practice and records	The log holds every decision and report since the last check, with references	No	Ready	Ready

Worked out	First check	Re-check
Readiness result	Not ready	Ready with gaps
Ready	12	13
Partly ready	3	3
Not ready	1	0
Not applicable	2	2
Blocking not Ready	1	0

First check, 18 Sep 2026: Not ready. RC-08 is blocking and was Not ready: the GDPR channel's deputy (Legal) has access; the NIS2 portal's deputy (Head of Information Security) had none. Had a NIS2 early warning been due that day while the primary signatory was away, nobody else could have submitted it.

Fix: RA-01, "Issue and test a NIS2 portal account for the Head of Information Security", owned by the Information Security Manager, due 30 Sep 2026, done 24 Sep 2026.

Re-check, 25 Sep 2026: RC-08 Ready, so the result is Ready with gaps. RC-05, RC-10, RC-17 stay Partly ready, each with an open action on the Gap Actions sheet; RC-15 and RC-16 are Not applicable, with the reason recorded.

Next: the full checklist again by 18 Mar 2027, or sooner if an authority, channel, signatory or the profile changes (RN-17).

Lists

Status	YesNo	Area	Regime	SignatoryRole	ActionStatus
Ready	Yes	Applicability	NIS2	Primary	Open
Partly ready	No	Authorities and channels	GDPR	Deputy	In progress
Not ready		People and authority	DORA		Done
Not applicable		Templates and facts

Suppliers and processors

Practice and records

Definitions

Definitions

Term	Meaning in this workbook
Applicability profile	The standing record, made before any incident, of which regimes can apply to us at all, in which role, and which authority each report goes to (RN-01).
Regime	A body of law that sets its own reporting duty: NIS2, DORA or the GDPR. Contracts, insurance policies and crime reporting add duties of their own, which P09 lists beside them.
Awareness	The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time.
Notification signatory	A person named in advance with the authority to submit reports in the organisation's name, and with working access to the channel each regime uses (RN-08).
Submission	Sending a report through the authority's channel, by a signatory who holds access to it, and recording the time, the channel and any reference the authority returns (RN-08, RN-09).
Authority's reference	The case or reference number the authority returns for a report. Every later report for the same incident quotes it.
Lead supervisory authority	Under the GDPR, the supervisory authority of the controller's main establishment, which receives the notification where processing crosses borders inside the EU. Otherwise the authority of the Member State concerned.
Fact base	The one record of the incident's facts that every report is drafted from, so reports to different authorities agree (RN-11).
Computer security incident response team (CSIRT)	The national team that receives NIS2 incident reports where the Member State has said so; otherwise the competent authority receives them. Named in your applicability profile: [[national CSIRT, or the competent authority where notifications go to it]].
Readiness check	One of the checks RC-01 to RC-18: something that must be true before an incident for a report to be made on time. Each names the rule it rests on.
Blocking check	A check without which a report cannot be made on time: RC-01, RC-04, RC-07, RC-08, RC-09, RC-12. A blocking check that is Not ready makes the result Not ready.
Ready	The evidence shows the check is met today, for every authority and channel it covers.
Partly ready	Some of the check is met, or it is met for some authorities or channels but not all. It needs a gap action.
Not ready	The check is not met, or there is no evidence that it is. It needs a gap action; if the check is blocking, fix it first.
Not applicable	The check cannot apply to you, for example DORA reporting for an organisation that is not a financial entity. Give the reason.
Result: Not ready	At least one blocking check is Not ready.
Result: Ready with gaps	No blocking check is Not ready, but at least one check is Partly ready, Not ready or not yet checked.
Result: Ready	Every check is Ready or Not applicable.
Access test	Signing in to the authority's portal or channel as the signatory, and reaching the point where a report could be submitted, without sending one. An account that exists but has not been used is not tested.
Gap action	The work that brings a check to Ready, with one owner, a due date and a status.
RN-nn	The rules of the Regulatory Notification Operating Procedure, RN-01 to RN-18. RD-nn are P09's reporting duties; CL-07 is P06's supplier notification clause; NR-02 is P12's registration duty.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its first check under the pack and its re-check a week later. Clear the EXAMPLE answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.5 — Contact with authorities	The checklist as a whole: contacts with authorities identified, kept current and ready to use
NIST CSF 2.0	RS.CO-02 — “Internal and external stakeholders are notified of incidents”	The checklist as a whole: the people, channels and templates ready so external stakeholders are notified of incidents
NIS2 — Directive (EU) 2022/2555	Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services	RC-04, RC-07 and RC-08: the authority, the channel and the people ready, so a significant incident can be notified without undue delay
NIS2 — Directive (EU) 2022/2555	Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing)	RC-08, RC-11 and RC-12: the early warning, the incident notification and the final report can be drafted and submitted within their deadlines
DORA — Regulation (EU) 2022/2554	Article 19(1) — report major ICT-related incidents to the relevant competent authority	RC-01 and RC-04, for financial entities: the competent authority for major ICT-related incidents named in the profile and the register
DORA — Delegated Regulation (EU) 2025/301	Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report	RC-08 and RC-09, for financial entities: a decider and a signatory reachable within the initial notification's time limits
DORA — Implementing Regulation (EU) 2025/302	Article 1 — the Annex I template is used for the initial notification, the intermediate report and the final report	RC-11, for financial entities: the reports drafted on the Annex I template
DORA — Implementing Regulation (EU) 2025/302	Article 4 — reports go through the secure electronic channels the competent authority provides; an entity unable to use them informs the authority through other secure means agreed with it, and resubmits through the channel if required	RC-04 and RC-06: the authority's secure channel recorded, and the other secure means agreed for when it cannot be used
DORA — Implementing Regulation (EU) 2025/302	Article 6 — an entity that has outsourced its reporting under DORA Article 19(5) informs its competent authority of the arrangement at the latest before the first notification, gives the third party’s name, contact details and identification code, and informs the authority when the outsourcing ends	RC-16: where a third party reports for a financial entity, the authority told of the arrangement before the first notification
GDPR — Regulation (EU) 2016/679	Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay	RC-04, RC-08 and RC-11: a notification to the supervisory authority can be made within 72 hours of awareness
GDPR — Regulation (EU) 2016/679	Article 56(1) — the supervisory authority of the main or single establishment of the controller or processor is competent to act as lead supervisory authority for its cross-border processing, without prejudice to Article 55	Authorities and Channels sheet: the lead supervisory authority named for cross-border processing

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.