Framework template
The EU directive that sets cybersecurity obligations for essential and important entities in critical sectors, including energy, transport, health, water and digital infrastructure.
Bundled template
NIS2 Directive
25 controls · 5 categories
| Control | Category |
|---|---|
| NIS2-GOV-01Management Responsibility | Governance |
| NIS2-GOV-02Management Training | Governance |
| NIS2-GOV-03Cybersecurity Policy | Governance |
| NIS2-21.2aRisk Analysis | Risk Management |
| NIS2-21.2bIncident Handling | Risk Management |
| NIS2-21.2cBusiness Continuity | Risk Management |
| NIS2-21.2dSupply Chain Security | Risk Management |
| NIS2-21.2eAcquisition Security | Risk Management |
| and 17 more | |
Network and Information Security Directive 2
In practice
NIS2 widens the sectors in scope, sets minimum risk-management measures, requires an early warning within 24 hours and an incident notification within 72 hours of a significant incident, and makes management accountable for oversight. Member states transpose it into national law.
The template
Each category as the catalogue holds it, with the controls it contains. Import the template and every control arrives with a status and an owner to assign.
Requirements
01
Policies on risk analysis, incident handling, business continuity, supply chain security and network security.
02
Early warning within 24 hours, notification within 72 hours and a final report within a month of a significant incident.
03
Assessment of cybersecurity risk in suppliers and service providers, with security requirements in the contracts.
04
Management approves and oversees the measures and can be held liable for failures.
How the Desk helps
Each step below is shipped: the template import in Compliance Studio, and workflows that run over the documents you choose, record their sources and hold for approval before export.
Run Extract obligations over the directive and your national transposition. The run records every source it read and holds for approval.
Run Review controls over your security policies, continuity plans and supplier terms; a control memo in Compliance Studio names the measures with gaps.
Evidence is held per measure with its status. Find missing evidence and Prepare audit checklist run over the evidence documents you select, with every source on record.
Other templates
Next step
Bring the policies you have and the last audit's request list. We will import the template, run the workflows with you and hand back the controls, the evidence on file and each run's sources.
Security
Encrypted at rest (AES-256) and in transit (TLS 1.3), hosted with a SOC 2 attested cloud provider. Your data never trains a model.
Security page