NIS 2 Directive Cybersecurity Management System
NIS 2 Directive Cybersecurity Management System
An editable documentation system for NIS 2: deciding whether it applies, holding the management body accountable, running cybersecurity risk management and reporting significant incidents on time.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Policies | 32 |
| Procedures & SOPs | 22 |
| Plans & Programmes | 27 |
| Forms & Records | 72 |
| Checklists & Audit Tools | 54 |
| Registers, Logs & Matrices | 63 |
| Job Descriptions & Organisation | 1 |
| Training & Awareness | 10 |
| Guides & Work Instructions | 7 |
| Tools & Workbooks | 10 |
| Other Documents | 7 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-NIS2-POL-001 | NIS 2 Cybersecurity Governance Policy | Word |
| AGS-NIS2-PRO-003 | Cybersecurity Risk Assessment Procedure | Word |
| AGS-NIS2-PRO-012 | Incident Identification and Classification Procedure | Word |
| AGS-NIS2-PRO-016 | Supplier Cybersecurity Risk Management Procedure | Word |
| AGS-NIS2-FRM-026 | Significant Incident Assessment Form | Word |
| AGS-NIS2-REG-011 | Cybersecurity Risk Register | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
NIS 2 makes management bodies answerable for cybersecurity. The first question is often the hardest: does it apply to you, and as an essential or an important entity? This system starts there, with Annex I and II screening and a classification tool.
From there it sets up governance and management-body oversight, a cybersecurity risk management process, and policies and procedures for the Article 21 measures. Incident management follows the Article 23 sequence, with report templates from the 24-hour stage to the final report. Excel tools calculate classification, Article 23 deadlines and a weighted readiness score.
The system is built on Directive (EU) 2022/2555, with obligations applied through national transposition law. A national overlay register records, for each Member State you operate in, the law, authorities, deadlines, reporting channels and penalties. Commission Implementing Regulation (EU) 2024/2690 is applied only to the entity types it names. ENISA Technical Implementation Guidance of June 2025 is used as non-binding guidance, and ISO/IEC 27001:2022, ISO/IEC 27005:2022 and ISO 22301:2019 appear as cross-references only. AGS is independent and is not affiliated with the European Commission, ENISA or any national authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.
What this system covers
- Scope and classification: Annex I and II screening, an essential-versus-important classification tool, jurisdiction and main establishment, DORA and critical-entity interplay, and the national transposition overlay.
- Governance and accountability: a governance policy, board oversight charter, CISO and compliance officer role profiles, a roles matrix, a management-body training plan and approval records.
- Risk management and Article 21 measures: policies, standards and procedures for access, cryptography, assets, networks, logging, backup, supply chain, vulnerability handling, testing, secure acquisition and development, and cyber hygiene.
- Incidents and Article 23 reporting: an incident response plan, a notification workflow and templates for the 24-hour, 72-hour, intermediate, progress and final reports.
- Implementing regulation: an applicability control matrix that decides whether Regulation (EU) 2024/2690 binds you and maps its Annex to controls and evidence.
- Evidence and review: a clause-by-clause compliance matrix, a policy-to-control matrix, KPIs, a gap assessment with 30-day, 60-day and 90-day plans, internal audit and management review.
Who it's for
Essential and important entities in Annex I and II sectors, the digital provider types covered by Regulation (EU) 2024/2690, and ICT suppliers drawn into their customers' NIS 2 due diligence. A NIS 2 compliance officer or CISO leads the work, with senior managers, legal teams, internal audit and consultants using it alongside.
If you want an ISO/IEC 27001 ISMS in the same document set, see the NIS 2 & ISO/IEC 27001:2022 Integrated Management System. Financial entities can pair this system with the DORA ICT Third-Party Risk & Digital Operational Resilience Management System.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in EU Compliance
See all 15
EU GDPR Website & E-Commerce Compliance Toolkit
EU Compliance283 documents $850USD
EU GDPR Data Protection Officer (DPO) Management System
EU Compliance282 documents $850USD
EU GDPR Privacy & Data Protection Awareness Training Package
EU Compliance337 documents $850USD