NIS2 Toolkit
An editable starter set to help you work towards NIS2 compliance — 12 Word and Excel documents covering management accountability (Article 20), the ten Article 21(2) measures, the Article 23 reporting timeline with ready-to-fill templates, and an overview of the authorities and CSIRTs in France, Spain, the Netherlands, Belgium and Poland.
Buy now — €199 one-time, VAT included
This toolkit is a set of editable templates and guidance. It does not guarantee certification and is not legal advice. Review, adapt and approve each document so that it reflects how your organization actually works. Certification is granted only by an accredited certification body after an independent audit.
What's inside (12 documents)
- Scope & Applicability Decision Guide — Decide whether NIS2 applies and whether you are essential or important.
- Article 21(2) Measures — Self-Assessment (xlsx) — The ten measures (a–j), rate status, gap, owner and date.
- Incident Reporting Procedure (Article 23) — The 24h / 72h / one-month timeline, step by step.
- Incident Notification Templates — Ready-to-fill early warning, notification and final report.
- Governance & Management Accountability (Article 20) — Management approval, oversight and a board training plan.
- Supply Chain Security Policy — Manage supplier risk with tiers and contract requirements.
- Supplier Security Questionnaire (xlsx) — A 12-question due-diligence questionnaire for suppliers.
- Risk Management Policy — All-hazards risk process aligned with Article 21(2)(a).
- Business Continuity & Crisis Management Policy — Backups, recovery objectives and a crisis team.
- National Authorities & CSIRT Overview — Who to register with and report to in FR, ES, NL, BE and PL.
- NIS2 Implementation Roadmap (xlsx) — A simple plan to track your NIS2 work to completion.
- README & Implementation Guide — The order to work through everything, in plain English.
A look inside
Incident reporting — the Article 23 timeline
24 hours: early warning (is it malicious? cross-border?). 72 hours: incident notification with an initial assessment. One month: final report with root cause and mitigation. Includes a ready-to-fill template for each stage.
National overview — a real example (checked 2026-09-29)
Belgium: competent authority CCB, national CSIRT CERT.be, register on the Safeonweb@work portal (general deadline 18 March 2025). Netherlands: Cyberbeveiligingswet applies from 15 August 2026; NCSC-NL as CSIRT, RDI as supervisor. Each country cited with official sources.
Article 21(2) self-assessment
All ten minimum measures a–j in one spreadsheet, in plain language, so you can rate where you stand, note the gap, and assign an owner and date.
Why this helps
NIS2 brings real duties: management accountability, a set of security measures, and incident reports on a strict 24h/72h/one-month timeline. This toolkit gives you the documents and templates to meet them, plus a country overview so you know who to register with and report to.
Not sure where you stand? Start with the free NIS2 checklist →
Buy now — €199 one-time, VAT included
Frequently asked questions
What exactly do I get?
A downloadable pack of 12 editable Word (.docx) and Excel (.xlsx) documents covering NIS2 governance (Article 20), the Article 21(2) measures, and incident reporting (Article 23), plus a country overview for FR, ES, NL, BE and PL and a README.
Does this make me NIS2 compliant?
No. It is a starting set of editable templates to help you prepare. NIS2 is implemented in national law, which differs per country and is still changing. This is not legal advice — confirm your national rules.
Which countries does the authority overview cover?
France, Spain, the Netherlands, Belgium and Poland. Each entry names the competent authority, the CSIRT and the registration route, with official sources and the date we checked (2026-09-29). Germany is not included in this edition.
Is it a one-time payment?
Yes — €199 once, VAT included (handled by our payment provider Dodo Payments). No subscription.
Does it work with the ISO 27001 Toolkit?
Yes. Many NIS2 measures map onto ISO 27001 controls, so you can run one risk process and reuse evidence across both.