NIS2 compliance in spreadsheets: what works and when to automate

A spreadsheet can run a small NIS2 program if it covers the ten Article 21 measure areas, the Article 23 incident clock, suppliers and management oversight, with an owner and a review date per row. It stops working when inventories drift faster than people update them and evidence has to come from live systems.

What does the law ask you to track?

Article 21(2) lists ten areas of cybersecurity risk-management measures: risk analysis and security policies, incident handling, business continuity, supply chain security, security in acquisition, development and maintenance including vulnerability handling, effectiveness assessment, hygiene and training, cryptography, HR security, access control and asset management, and multi-factor authentication and secured communications. Article 23 sets reporting for significant incidents: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification. Article 20 makes the management body responsible for approving and overseeing the measures.

National laws implement the Directive and may add detail, so confirm yours.

What does a working NIS2 workbook look like?

Six tabs are enough for a small organisation.

1. Scope and entity status. Which services are in scope, whether you are essential or important, who supervises you, links to the national law.
2. Measures register. One row per Article 21(2) area, subdivided into the practices you chose. Columns: requirement, what you do, owner, evidence link, last tested, next review, status.
3. Asset and supplier inventory. Systems, data, suppliers, criticality, owner, last supplier review, assurance documents held.
4. Risk register. Risk, likelihood, impact, treatment, owner, due date, status, decision log.
5. Incident log and clock. Date and time aware, who classified it, significant or not, early warning sent, notification sent, final report due. Add a drill sheet.
6. Management reporting. One row per review: date, attendees, decisions, resources approved. This is your Article 20 trail.

Use consistent IDs, protect edit rights, and keep a change log. Version the file monthly.

What routines make it real?

• Monthly: update inventories, review open risks, check supplier renewals.
• Quarterly: test two measures, such as a restore and an access review, and log results with links.
• Twice a year: run an incident drill against the 24 hour, 72 hour and one month deadlines.
• Annually: management body review of the full workbook and risk acceptance.

Assign an owner for each tab. A spreadsheet without owners is a document, not a program.

When does the spreadsheet fail?

Watch for these signals.

• The inventory is wrong when you check it against cloud accounts or the identity provider.
• Evidence links break or point to screenshots that nobody can reproduce.
• More than a handful of people edit and versions diverge.
• Supplier reviews slip because there is no reminder system.
• Vulnerability and patch status lives in other tools, and the workbook copies it by hand.
• Customers or regulators ask for proof across several frameworks and each answer takes days.
• Incident timing depends on one person remembering a deadline.

If three of these apply, automate the parts that change fastest, inventory, vulnerability status and evidence collection, and keep human decisions in the workbook: risk acceptance, classification calls and management minutes.

What are the common mistakes?

• Treating Article 21 as a checklist of tools rather than appropriate and proportionate measures you can justify.
• No decision log. Proportionality means you must explain choices.
• Supplier tab with names but no assessment of their practices. Article 21(3) points at supplier vulnerabilities, product quality and secure development practices.
• Incident clock defined but never drilled.
• Management never sees the workbook.

What to do

1. Confirm scope, status and national law.
2. Build the six tabs and assign owners.
3. Fill the measures register from what you already do, then list gaps as tasks.
4. Populate the inventories from cloud, identity and finance exports, not memory.
5. Schedule the monthly, quarterly and annual routines.
6. Run the first incident drill and log timings.
7. Set a rule: when three failure signals appear, evaluate automation.

Quick check

How Safeguard helps automate this

Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews, which gives the team time for other work. For the supply chain and vulnerability handling rows, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. Your supervisory authority decides compliance. Book a call.

Sources

• NIS 2 Directive, Article 20
• NIS 2 Directive, Article 21
• NIS 2 Directive, Article 23

Article texts come from an unofficial reproduction. The official text is on EUR-Lex.

Last reviewed: 18 October 2026.