NIS2 ISMS Policy: What Each Section Must Say to Survive an Audit (+ Template)
Most NIS2 policies miss the disciplinary clause — and half fail the scope test. Here’s what each section must say to satisfy Article 21(2)(a).
-
-
How to Build a NIS2-Compliant BIA in 5 Steps — RTO, RPO, and MTPD Included
No BIA = a BC Plan built on guesswork. Build yours in 5 steps: critical functions, dependencies, RTO/RPO/MTPD, and SPOFs — NIS2 Art. 21(2)(c) compliant.
-
Your NIS2 Gap Analysis in 5 Phases: Article 21 Control Inventory to RAG-Scored Remediation Roadmap
Where do your NIS2 controls fall short? A 5-phase gap analysis from Article 21 inventory to RAG-scored remediation roadmap.
-
5 NIS2 Maturity Levels: Self-Assess Your Compliance Readiness and Close the Gap to Level 3
Most NIS2-scoped organisations start at Level 1–2. Auditors expect Level 3. Use this Article 21 maturity framework to find your gap — and close it before June 2026.
-
NIS2 Article 29 Explained: How to Join an ISAC, Share Threat Intelligence, and Protect Your Information Under EU Law
NIS2 information sharing explained: Article 29 ISAC arrangements, Article 30 voluntary CSIRT notification, TLP confidentiality, and the Art. 29(4) obligation.
-
How to Write a NIS2 Vulnerability Disclosure Policy: Article 12 Requirements, Bug Bounty Programs, and CSIRT Coordination
Most NIS2 entities overlook Article 21(2)(e): here’s what your CVD policy must include, how CSIRT coordination works, and when a bug bounty programme helps.
-
NIS2 Supervisory Measures Explained: What Articles 32 and 33 Mean for Your Next Inspection
Ready for a NIS2 inspection? Learn what evidence inspectors request, how compliance notices work, and when Article 32 management suspension powers apply.
-
How to Report a NIS2 Significant Incident: 24-Hour, 72-Hour, and 30-Day Obligations Explained
Miss the NIS2 early warning deadline and the delay is itself a violation. Article 23 significance test, all three report content requirements, and step-by-step CSIRT workflow.
-
Which EU Authority Actually Supervises Your Organisation Under NIS2? Article 26 Explained
Which EU authority supervises your organisation under NIS2? Article 26 uses a three-tier test — getting it wrong creates multi-country enforcement risk.
-
How to Bring a Multi-Site Food Operation into NIS2 Compliance: ERP, SCADA, and Cold Chain Under Annex II
How NIS2 Article 21 maps to food industry ERP, SCADA, and cold chain systems — scope check, multi-site framework, and 90-day action plan for food operators.
