NIS2 Complete Toolkit

Description

You’ll walk into your NIS2 audit with every Article 21 security measure already documented—not scrambling to write policies the weekend before. The Complete Toolkit hands you 66 editable compliance templates—54 Word policies and 12 Excel workbooks—each mapped to the NIS2 Directive, CIR 2024/2690 Annex, and ENISA guidance with ISO 27001:2022 cross-references built in. You also get 10 implementation guides—role matrices, flowcharts, and quick-start cards—so you know exactly how to deploy them. You fill in your company details; the regulatory mapping is done for you.

New in v1.2 — included free: the NIS2 AI Assistant Pack — 4 prompts that turn ChatGPT, Claude or Gemini into a NIS2 readiness auditor, risk-register co-pilot, policy gap-checker and incident-triage assistant (a separate download). Plus your Risk Assessment, Gap Analysis and Internal Audit spreadsheets are now interactive — auto-calculating dashboards with a 5×5 risk heat-map and maturity/conformance scoring.

The Audit Is Coming—and Your Policy Folders Are Empty

You already know the deadline passed. The NIS2 Directive had to be in national law by 17 October 2024, enforcement frameworks are live across the EU, and your national competent authority can now audit and sanction you for missing documentation. That’s the part you can’t change.

Here’s what keeps you up at night. It isn’t the directive—it’s the gap between what you’re responsible for and what you can actually produce on the day:

1. You’re the one who has to produce the evidence. When the auditor asks for your risk assessment, your incident-handling policy, your board sign-off—those documents have to already exist. You can’t draft them in the meeting.
2. If it goes wrong, it’s your name on it. Article 20 puts your management body personally responsible for approving and overseeing risk-management measures. “We hadn’t written it down yet” is not a position you want to defend—and the fines under Article 34 can reach €10,000,000 or 2% of worldwide annual turnover, whichever is higher.
3. And you shouldn’t need a €6,000 consultant just to be compliant. Forty hours of someone billing €150 an hour to write policies that already follow a known structure—that’s a tax on not having a template, not a tax on being secure.

The villain here isn’t the regulation. It’s the blank page—every empty policy folder standing between you and an audit you can’t afford to fail, and every weekend you’d lose trying to fill them from scratch. The gap most organisations face isn’t technical. It’s documentary. And that’s a gap you can close fast.

You Don’t Have to Face the Blank Page Alone

We know what it’s like to face an audit with no documentation and a deadline that won’t move—to stare at a list of twenty-one security domains and wonder which policy proves which requirement. The Complete Toolkit was built so you never have to start from that blank page. You bring the knowledge of your own organisation; it brings the structure, the wording, and the regulatory mapping.

Every measure listed in Article 21(2)(a) through (j) is covered. Each of the 66 compliance templates follows the same 9-section structure—Purpose, Scope, Definitions, RACI matrix, Requirements, Exceptions, Monitoring, References, and Appendix—so you can hand any one of them to an auditor and they’ll know exactly where to look. You’ll find pre-filled RACI tables for six organisational roles, the fields you need to complete highlighted in red so you never miss one, and 3+ KPIs per document so your board reporting writes itself.

What’s Inside: 66 Templates + 10 Implementation Guides

You receive 66 editable compliance templates (54 Word + 12 Excel) plus 10 implementation guides, organised into 10 functional categories so you can find what the auditor asks for in seconds:

See all 76 files

1. 00a — Welcome & Overview
2. 00b — Implementation Guide
3. 00c — Master Map
4. 00d — Role Matrix
5. 00e — Quick-Start Card: NIS2 Officer
6. 00f — Quick-Start Card: IT Lead
7. 00g — Quick-Start Card: HR Manager
8. 00h — Incident Flowchart
9. 00i — Implementation Flowchart
10. 00j — Document Dependency Map
11. 01 — Project Launch Pack
12. 02 — Project Plan
13. 03 — Initial Training Plan
14. 04 — Information Security Policy
15. 05 — Risk Assessment Methodology
16. 06 — Risk Assessment Table
17. 07 — Risk Treatment Table
18. 08 — Acceptance of Residual Risks
19. 09 — Risk Assessment & Treatment Report
20. 10 — Risk Treatment Plan
21. 11 — IT Security Policy
22. 12 — Clear Desk & Clear Screen Policy
23. 13 — Mobile & Remote Working Policy
24. 14 — BYOD Policy
25. 15 — Physical Security Policy
26. 16 — Information Classification Policy
27. 17 — Asset Management Policy
28. 18 — IT Asset Register
29. 19 — Network Security Policy
30. 20 — Vulnerability & Patch Management
31. 21 — Logging & Monitoring Policy
32. 22 — Change Management Policy
33. 23 — Backup Policy
34. 24 — Information Transfer Policy
35. 25 — Secure Communications Policy
36. 26 — Secure Disposal Policy
37. 27 — Encryption & Cryptographic Controls
38. 28 — Access Control Policy
39. 29 — Authentication Policy (incl. MFA)
40. 30 — Password Policy
41. 31 — ICT Acquisition Policy
42. 32 — ICT Security Requirements
43. 33 — HR Security Policy
44. 34 — Statement of Acceptance
45. 35 — BIA Methodology
46. 36 — BIA Questionnaire
47. 37 — Business Continuity Strategy
48. 38 — Business Continuity Plan
49. 39 — Crisis Management Plan
50. 40 — Exercise Plan
51. 41 — Exercise Report
52. 42 — Supplier Security Policy
53. 43 — Supplier Security Clauses
54. 44 — Confidentiality Statement
55. 45 — Supplier Directory
56. 46 — Measurement Methodology
57. 47 — Measurement Report
58. 48 — Incident Handling Policy
59. 49 — Minor Incident Procedure
60. 50 — Incident Log
61. 51 — Incident Notification Forms
62. 52 — Corrective Actions Register
63. 53 — NIS2–ISO 27001 Mapping Spreadsheet
64. 54 — Gap Analysis Workbook
65. 55 — Training Tracker
66. 56 — Internal Audit Checklist
67. 57 — CIR 2024/2690 Compliance Matrix
68. 58 — Board Briefing Pack
69. 59 — Board Resolution Template
70. 60 — Supplier Self-Assessment Questionnaire
71. 61 — Supplier Compliance Checklist
72. 62 — NCA Registration Guide
73. 63 — GDPR–NIS2 Crosswalk Checklist
74. 64 — Disaster Recovery Plan
75. 65 — Audit Procedure
76. 66 — Audit Report Template

How You Get from Empty Folders to Audit-Ready—in 3 Steps

1. Download instantly. The moment your payment clears, all 76 files are yours—no waiting, no onboarding call.
2. Fill in your company details. Work through the red-highlighted fields—your name, scope, roles, thresholds—using the Implementation Guide and Quick-Start Cards as your map. The structure and regulatory wording are already in place.
3. Hand the audit-ready pack to your board. Walk into the audit with a complete, Article-mapped set of policies—and hand your CISO the Board Briefing Pack that proves due diligence.

How Every Article 21 Measure Is Covered

So you can prove completeness on the day, the table below maps each Article 21(2) security measure to the toolkit documents and CIR 2024/2690 Annex sections that address it.

Which Product Fits Where You’re Starting From

If you want full coverage across every domain, the Complete Toolkit gives you all 66 compliance templates (54 Word + 12 Excel) plus 10 implementation guides. If your work is sector-specific, the sector packs give you fully rewritten, sector-adapted versions—not subsets of this toolkit. Pick the column that matches your industry and scope.

If This Is You, the Toolkit Was Built for You

You’re the CISO or NIS2 Officer. You need a documentation set that’s audit-ready from day one. You’ll present a complete Article 21 evidence package to your national competent authority—policies pre-structured, regulatory references already embedded—instead of assembling it under pressure.

You’re the IT Security Lead. You need implementation-level detail, not abstract policy statements. You’ll work from RACI tables for six roles, implementation checklists (0–4 weeks and 1–3 months), and measurable KPIs—so your team knows exactly who does what, and by when.

You’re the Compliance Manager. You need the regulatory mapping done before you start drafting. You’ll reference the applicable NIS2 Article, CIR 2024/2690 Annex section, and ENISA guidance on every template—saving yourself weeks of cross-referencing.

You’re a Board Member or CEO. You need to demonstrate Article 20 due diligence. You’ll have the Board Briefing Pack and Board Resolution template that show your management oversight is documented and active.

Common Questions About the NIS2 Complete Toolkit

Are these templates legal advice?

No. These templates are general samples intended as a starting point for your NIS2 documentation. They do not constitute legal advice. You should have every document reviewed by a qualified professional before adoption, taking into account your sector, jurisdiction, and organisational context.

Can I customise the documents?

Yes. You receive every template as an editable DOCX or XLSX file. The fields you need to complete—company name, scope, roles, thresholds—are highlighted in red bold text so you never miss one. You can add your logo, adjust section scope, and extend any template to fit your requirements.

What format are the files?

You get DOCX (Word) and XLSX (Excel) files. They open in Microsoft Word, Google Docs, LibreOffice Writer, and any application that supports the Open XML format. You won’t need any proprietary software.

What if a document doesn’t fit my environment?

This is a digital download, so the right of withdrawal is waived at checkout in accordance with EU Directive 2011/83/EU, Article 16(m)—you’ll be asked to consent to this before payment. To protect you anyway, there’s a 30-day update-or-add pledge: if a template doesn’t fit your environment, email us within 30 days and we’ll update it—or add a document outside the standard scope. You keep everything either way.

How do I know these cover all NIS2 requirements?

Every document references the specific Article 21(2) measure it addresses, the corresponding CIR 2024/2690 Annex section, and applicable ENISA guidance. The compliance matrix above maps all ten measures to their toolkit documents, and Doc 57 (CIR Compliance Matrix) gives you a standalone crosswalk to hand to an auditor.

Are updates included?

Yes. Your purchase includes one year of updates. As EU guidance evolves—new ENISA publications, member state implementation acts, or CIR amendments—you’ll be able to download the updated templates at no additional cost during your update period.

I already have ISO 27001 — do I still need this?

Yes. While NIS2 and ISO 27001:2022 share significant overlap, the Directive imposes additional requirements that ISO alone does not cover—including incident notification timelines (Article 23), supply chain due diligence (Article 21(2)(d)), board-level governance obligations (Article 20), and specific CIR 2024/2690 technical measures. Doc 53 (NIS2–ISO 27001 Mapping Spreadsheet) shows you every gap, so you know exactly where your existing ISMS needs supplementing.

Walk Into Your Audit Confident

Picture the day differently. Instead of scrambling, you walk into the audit with a complete, Article-mapped pack in hand—every Article 21 measure documented, every CIR section referenced, your board briefing ready to forward. The auditor asks for your risk register; you have it. They ask for your incident-handling policy; you have it. You’ve closed the documentary gap, and your name is on a paper trail you can stand behind. That’s what the next step buys you.