EU Directive 2022/2555 — in force
NIS2.Documented.Audit-Ready.
76 editable Word and Excel files — 66 templates and 10 implementation guides — covering all ten Article 21(2) measures. Each document names the NIS2 article and the CIR 2024/2690 Annex section it implements, with ISO 27001:2022 cross-references. Plain English, ready to adapt.
- One-time payment
- Instant download
- VAT invoice, EU reverse charge
- 30-day update-or-add pledge
“It provides detailed policy and procedure templates as well as detailed NIS2 compliance implementation guides.”
† Polish edition; both companies also work with us on other projects. Read what three of our customers say ↓
The Complete Toolkit at a glance
The same files are in the Complete Toolkit (€497) and the Enterprise License (€997). The Quick-Start Bundle (€249) contains 18 of them.
Which files cover which measure
Pick an Article 21(2) point to see the documents that implement it and the CIR 2024/2690 Annex section it is specified in. Several documents support more than one measure.
Art. 21(2)(a) — policies on risk analysis and information system security
CIR 2024/2690 Annex, sections 1 and 2
- 04 Information Security Policy
- 05 Risk Assessment Methodology
- 06 Risk Assessment Table (Risk Register) Excel
- 07 Risk Treatment Table Excel
- 08 Acceptance of Residual Risks
- 09 Risk Assessment and Treatment Report
- 10 Risk Treatment Plan
- 11 IT Security Policy
- 54 NIS2 Gap Analysis Excel
Art. 21(2)(b) — incident handling
CIR 2024/2690 Annex, section 3
- 48 Incident Handling Policy
- 49 Minor Incident Response Procedure
- 50 Incident Log / Register Excel
- 51 Incident Notification and Reporting Forms
- 52 Corrective Actions Register Excel
- 21 Logging and Monitoring Procedure
- 00H Incident Response Flowchart — Article 23 notification timeline
Art. 21(2)(c) — business continuity, backup management, disaster recovery, crisis management
CIR 2024/2690 Annex, section 4
- 23 Backup Policy
- 35 Business Impact Analysis Methodology
- 36 Business Impact Analysis Questionnaire Excel
- 37 Business Continuity Strategy
- 38 Business Continuity Plan
- 39 Crisis Management Plan
- 40 Exercising and Testing Plan
- 41 Exercising and Testing Report
- 64 Disaster Recovery Plan
Art. 21(2)(d) — supply chain security
CIR 2024/2690 Annex, section 5
- 42 Supplier Security Policy
- 43 Supplier Security Clauses for Contracts
- 44 Confidentiality Statement
- 45 Supplier Directory Excel
- 60 Supplier Self-Assessment Declaration
- 61 Supplier Compliance Checklist
Art. 21(2)(e) — security in acquisition, development and maintenance, including vulnerability handling
CIR 2024/2690 Annex, section 6
- 31 ICT Acquisition, Development, and Maintenance Policy
- 32 ICT Security Requirements Appendix
- 22 ICT Change Management Procedure
- 20 Vulnerability and Patch Management Procedure
- 19 Network Security Policy
Art. 21(2)(f) — assessing the effectiveness of the measures
CIR 2024/2690 Annex, section 7
- 46 Cybersecurity Measurement Methodology
- 47 Cybersecurity Measurement Report
- 65 Internal Audit Procedure
- 56 Internal Audit Checklist Excel
- 66 Internal Audit Report
- 57 CIR Compliance Matrix Excel
Art. 21(2)(g) — basic cyber hygiene and cybersecurity training
CIR 2024/2690 Annex, section 8
- 03 Initial Cybersecurity Training Plan
- 55 Training Tracker Excel
- 34 Statement of Acceptance of Cybersecurity Policies
- 12 Clear Desk and Clear Screen Policy
- 13 Mobile Device and Remote Work Policy
- 14 Bring Your Own Device (BYOD) Policy
Art. 21(2)(h) — cryptography and encryption
CIR 2024/2690 Annex, section 9
- 27 Encryption and Cryptographic Controls Policy
- 25 Secure Communication Policy
Art. 21(2)(i) — human resources security, access control, asset management
CIR 2024/2690 Annex, sections 10, 11, 12 and 13
- 33 Human Resources Security Policy
- 28 Access Control Policy
- 17 Asset Management Procedure
- 18 IT Asset Register Excel
- 16 Information Classification Policy
- 24 Information Transfer Policy
- 26 Disposal and Destruction Policy
- 15 Physical and Environmental Security Policy
Art. 21(2)(j) — multi-factor authentication and secured communications
CIR 2024/2690 Annex, section 11 (11.6 and 11.7)
- 29 Authentication Policy
- 30 Password Policy
- 25 Secure Communication Policy
Governance, registration and reporting (Articles 20, 23 and 27)
Management-body approval, oversight and training; notification deadlines; registration
- 01 NIS2 Compliance Project — Launch Decision
- 02 NIS2 Compliance Project Plan
- 58 Board Briefing — NIS2 Cybersecurity Compliance
- 59 Board Resolution on Cybersecurity
- 63 NCA Registration Guide
- 53 NIS2–ISO 27001 Mapping Excel
- 62 GDPR–NIS2 Parallel Compliance Checklist
- 00A–00J Welcome, implementation guide, master map, role matrix, quick-start sheets, flowcharts, dependency map
The full list of all 76 files is on the Inside the toolkit page.
Real pages, not mock-ups
Two pages from Doc 04, Information Security Policy, as they appear in the free sample. Every template uses placeholders such as {{COMPANY_NAME}} that you replace once.
Built for your industry
Sector packs are rewritten for OT/ICS environments — different files, not subsets of the generic toolkit.
OT/ICS security, supply chain obligations and asset management in production. 22 Word files (12 sector-adapted + 10 guides).
Critical infrastructure requirements, grid-specific risk and incident categories. 24 Word files (14 energy-specific + 10 guides).
Process control systems, SCADA security, requirements for newly affected chemical companies.
Coming soon
Supply security, ICS safety in production, reporting obligations for food manufacturers.
Coming soon
What our customers say
“I’ve just purchased the Complete Toolkit. It provides detailed policy and procedure templates as well as detailed NIS2 compliance implementation guides. Believe this will be a very useful tool for us.”
“The toolkit gave us a clear plan from day one. The implementation guide set out the order of work and who is responsible for what, and the board briefing and draft resolution allowed our management board to take the key decisions quickly. Instead of drafting policies, procedures and registers from scratch, we adapted ready-made documents based on Polish law, which saved us a great deal of time.”
“We recommend NIS2 Templates to engineering and industrial companies facing NIS2.” Among the reasons the company gives: clear roles from day one, ready-to-use registers and incident notification forms with the statutory deadlines, and “an implementation our own team could carry out, without a lengthy consulting project.”
GAZOMET and CGas Controls use the Polish edition of the toolkit, which follows the same structure adapted to the Polish KSC Act, and also work with the publisher on other projects. All references are published with the authors’ consent.
Choose your package
One-time payment, prices excluding VAT. Businesses only: EU customers with a valid VAT number are invoiced under the reverse charge.
- Risk management (21(2)(a))
- Incident response (21(2)(b))
- Access control and authentication
- Core security policies
- One organisation
- All 10 Article 21(2) measures
- CIR 2024/2690 Annex mapping
- ISO 27001:2022 cross-references
- Board governance and measurement tools
- One organisation
- Up to 5 legal entities in a group
- For consultants, MSPs and groups
- 48h priority support
- Lifetime updates
- More than 5 entities: ask for a quote
30-day update-or-add pledge. This is a digital download, so the right of withdrawal is waived at checkout. If a template doesn’t fit your environment, email us within 30 days and we’ll update it — or add a document outside the standard scope. You keep everything either way.
A registered EU publisher, not an anonymous store
NIS2-Templates.com is published by ZILIO Marzena Rewers, Gliwicka 35, 42-600 Tarnowskie Góry, Poland (EU VAT PL6451705993). The same publisher maintains the German site nis-2-richtlinie.com and the Cyber Resilience Act and ISO 27001 template lines.
The templates are general samples, not legal advice. Have them reviewed by a qualified legal or IT security professional before adoption.
Questions buyers ask first
Will an auditor accept templates we bought?
Auditors assess your documented security measures and the evidence that you apply them, not who drafted the first version. Each template names the Article 21(2) measure and the CIR 2024/2690 Annex section it implements and ships fully editable, so you adapt it to your organisation. They are general samples — have them reviewed by a qualified professional before adoption.
Do I still need a consultant?
The templates do the documentation groundwork — policies, risk registers, incident plans and board documents, already structured and mapped to the regulation. You add your organisation-specific detail. Many buyers use them to narrow a consultant’s scope rather than remove it.
What exactly do I receive?
A ZIP file with Word (.docx) and Excel (.xlsx) documents, available for download immediately after payment. The Complete Toolkit and Enterprise License contain 76 files: 66 templates (54 Word + 12 Excel) and 10 implementation guides. The full file list is in the free sample.
What if a template doesn’t fit my organisation?
That is what the 30-day update-or-add pledge covers: email us within 30 days and we’ll update the template, or add a document outside the standard scope. You keep everything either way.
Can we pay by invoice?
We sell to businesses only. Checkout asks for your company name and, in the EU, your VAT number; EU orders with a valid VAT number are invoiced under the reverse charge. See Invoicing & VAT.
Am I even affected?
The free applicability checker shows which NIS2 category organisations of a given sector and size typically fall into — no registration required.