Acceptable Use Policy Template: NIS2 Never Names It, but 8 CIR Annex Points Shape What Staff Sign
NIS2 never says ‘acceptable use policy’ — yet 8 CIR Annex points shape what staff sign. Template sections, owners, and the consent line to leave out.
-
-
Data Classification Policy Under NIS2: One Level Sets 9 Other Requirements — Labels, Handling Rules and the Evidence Auditors Check
A data classification policy under NIS2 sets the level that 9 other CIR controls read. Build four-axis levels, handling rules and the evidence auditors check.
-
What Is DORA? The EU Digital Operational Resilience Act Explained — 20 Entity Types, 19 Critical Tech Providers, and Where NIS2 Still Applies
The DORA regulation covers 20 types of financial firm and 19 named tech providers. Its 4-hour reporting clock, penalties and three links to NIS2, explained.
-
Fintech Compliance: DORA, NIS2, Both or Neither? A Scope Map for 8 Fintech Business Models
Payment, e-money and crypto fintechs are usually DORA-only: NIS2’s annexes never list them. A scope map of 8 fintech models, including those neither law reaches.
-
How to Build a NIS2 Internal Audit Program When the Rules Only Say “Planned Intervals”: Scope, Cadence, Evidence
No NIS2 text sets an audit interval, so your audit program’s own plan becomes the benchmark. Scope, a risk-tiered 3-year cadence, and the evidence to keep.
-
Security Awareness Training Platform or Policy Template? 13 NIS2 Training Requirements and Which One Proves Each
By our count, a security awareness training platform alone proves 2 of NIS2’s 13 Annex 8 training requirements. See which ones still need your own documents.
-
IT Security Policy Template: The 11 Elements NIS2 Now Requires by Name
NIS2’s implementing regulation names 11 elements your IT security policy must contain. Five are missing from almost every free template – here they are.
-
NIS2 Document Control Procedures: Versioning, Approval, and the Retention Period the Law Won’t Give You
NIS2 sets no retention period and never uses the word version. Here is what CIR 2024/2690 Annex 1.1.1 binds you to, and how to derive a defensible schedule.
-
NIS2 Change Management Policy: Article 21(2)(e), Not (a) — and the Annex 6.4 Gate Before You Deploy
NIS2 change management policy sits under Article 21(2)(e), not (a). What Annex 6.4 binds you to in four sentences, and which ITIL extras are only ENISA advice.
-
NIS2 Data Retention Policy: 3 Mentions, No Number — What to Keep, How Long, and What Auditors Check
NIS2 names retention three times and never gives a number. Here is how to build a data retention policy auditors accept — and defend the periods you set.
