Guide

Your NIS2 business continuity policy template needs three documents, not one. See the CIR 2024/2690 checklist for what each must contain.

Auditors check 31 specific controls under NIS2 Art. 21(2)(c). See the evidence each one requires — and the 6 that fail audits most often.

Your BCP looks compliant until an auditor asks for backup test records. 6 NIS2 business continuity mistakes under CIR Annex 4 — and the fix for each.

8 NIS2 incident response mistakes that turn a routine incident into a missed deadline — from unclear classification to untested plans — and how to fix each one.

28 controls, evidence formats, and the 5 that fail most NIS2 incident-handling audits, plus auditor interview questions for your IR team (Art. 21(2)(b)).

Most NIS2 templates confuse policy, plan, and playbook. Here’s the CIR-grounded distinction — plus the exact sections your IR policy must include.

NIS2 incident handling: the classification matrix, full CIR Section 3 checklist, and mandatory IR plan fields most Article 21(2)(b) guides skip entirely.

Most NIS2 risk registers miss the policy hierarchy and proportionality test Article 21(2)(a) also requires — see the structure that closes the gap.

What a NIS2 risk policy must contain: the 11 CIR 2024/2690 elements, the disciplinary clause most templates skip, and the board-approval evidence.

19 CIR 2024/2690 controls mapped to Article 21(2)(a), the evidence type each one requires, and the 5 controls auditors ask for first.