One procedure per process — not four documents on the same subject. Every procedure opens with a coverage table stating which obligation it satisfies and whether that obligation comes from the Directive, the Implementing Regulation or your national law.
Written on the European layer and usable in any Member State: everything that varies by country lives in one document, the National Annex, which you complete once.
There is no cut-down version, because a NIS-2 kit that covers half of Article 21 is not a cheaper option — it is an incomplete one, and a supervisory check reads it that way.
Written on the European layer and usable in any Member State. Editable DOCX and XLSX, ready to tailor.
VAT is added at checkout according to your country. Businesses in another EU Member State can enter a VAT number for reverse charge. Instant download.
Every in-scope entity must address all ten measures of Article 21(2), plus the governance duties of Article 20 and the reporting deadlines of Article 23. The kit covers all of them, and names the procedure that does it.
| Reference | Obligation | Documented in |
|---|---|---|
| Art. 20 | Governance and management body accountability | Governance & Scope |
| Art. 21(2)(a) | Risk analysis and information security policies | Risk Management |
| Art. 21(2)(b) | Incident handling | Incidents & Notification |
| Art. 21(2)(c) | Business continuity, backup, crisis management | Backup, Continuity & Crisis |
| Art. 21(2)(d) | Supply chain security | Supply Chain Security |
| Art. 21(2)(e) | Acquisition, development and maintenance; vulnerabilities | Secure Operations & Change |
| Art. 21(2)(f) | Assessing the effectiveness of measures | Effectiveness & Audit |
| Art. 21(2)(g) | Basic cyber hygiene and training | HR, Training & Cyber Hygiene |
| Art. 21(2)(h) | Cryptography and encryption | Asset & Information Protection |
| Art. 21(2)(i) | HR security, access control, asset management | Access Control & Authentication |
| Art. 21(2)(j) | Multi-factor authentication, secure communications | Network & Communications |
| Art. 23 | Significant incident reporting — 24h / 72h / 1 month | Incidents & Notification |
Entities in the digital infrastructure and digital provider sectors are also subject to Commission Implementing Regulation (EU) 2024/2690, which applies directly and identically across the Union. The kit maps to all thirteen sections of its Annex and carries its entity-specific incident thresholds.
Each process has exactly one procedure covering every aspect of it. Business continuity is one document, not seventeen. Forms exist only where a record is required, and everything continuous lives in the workbook.
Impact analysis, recovery objectives, backup, disaster recovery, crisis management and exercising are one document. Nobody running a crisis has time to hold seventeen files open.
Each obligation states whether it comes from the Directive, from the Implementing Regulation, or from national law. You see at a glance what applies unchanged in your country.
No procedure names an authority, a portal, a deadline or a national threshold. Those values live in a single document you complete once for your jurisdiction.
Retention periods are stated in one procedure. Indicators and targets in one. No document declares its own, so nothing drifts out of step with the rest.
Every step names one accountable role and one output record. A step with no record has not been performed — and the output column is the evidence list for internal audit.
Where a national rule is still moving, the kit says so and gives you a field for the date you last checked. The Legal register sheet exists to keep that current.
One-time payment, twelve months of updates. Editable DOCX and XLSX, ready to tailor.
Documentation templates, not legal advice and not certification. NIS-2 is implemented through national law that varies by Member State; confirm your obligations against the legislation and the competent authority that apply to you.
