NIS 2 & ISO/IEC 27001:2022 Integrated Management System
NIS 2 & ISO/IEC 27001:2022 Integrated Management System
One editable document set that runs an ISO/IEC 27001:2022 information security management system and meets NIS 2 cybersecurity obligations at the same time.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Manuals | 1 |
| Policies | 34 |
| Procedures & SOPs | 34 |
| Plans & Programmes | 29 |
| Forms & Records | 61 |
| Checklists & Audit Tools | 69 |
| Registers, Logs & Matrices | 68 |
| Job Descriptions & Organisation | 2 |
| Training & Awareness | 20 |
| Guides & Work Instructions | 13 |
| Tools & Workbooks | 24 |
| Other Documents | 13 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-NIS2-03-MAN-02 | Integrated ISMS-NIS 2 Governance Manual | Word |
| AGS-NIS2-06-PRO-02 | Risk Assessment and Treatment Procedure | Word |
| AGS-NIS2-09-PRO-02 | Incident Response Procedure | Word |
| AGS-NIS2-08-PRO-02 | Supplier Security Management Procedure | Word |
| AGS-NIS2-09-FRM-08 | NIS 2 Significant Incident Assessment | Word |
| AGS-NIS2-06-REG-14 | ISO-IEC 27001 Statement of Applicability | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
Many organisations caught by NIS 2 already run, or plan, an ISO/IEC 27001 ISMS. This system joins the two: one governance structure, one risk process, one Statement of Applicability, and evidence that serves both the supervisory authority and an ISO/IEC 27001 audit.
It opens with NIS 2 applicability and a regulatory profile. Every Annex point of Commission Implementing Regulation (EU) 2024/2690 is mapped to an owner, documents and evidence, with an applicability check before any of it is treated as binding. A NIS 2-to-ISO/IEC 27001 Annex A matrix shows where ISMS controls support NIS 2 measures, as an aid and not an equivalence. Organisations that already hold ISO/IEC 27001 certification can take a fast track: map existing documents and add the NIS 2 legal evidence.
Directive (EU) 2022/2555 is applied through national transposition law, with a national transposition matrix. ISO/IEC 27001:2022 clauses and Annex A controls are cited by number and identifier, with ISO/IEC 27002:2022 for control titles, and the control text is left to your own licensed copy. ENISA Technical Implementation Guidance of June 2025 supplies non-binding evidence examples. AGS is independent and is not affiliated with the European Commission, ENISA or any national authority. Regulations are referenced by citation. Standards are referenced by number and title only, and no standard text is included.
What this system covers
- Start here: a user guide, scope statement and mapping matrices from NIS 2 articles to documents and evidence.
- NIS 2 applicability: an applicability procedure, classification, jurisdiction, registration and a regulatory contact register.
- Integrated governance: a governance manual, top-level policy, steering committee terms of reference, a management-body training programme and a legal and regulatory compliance procedure.
- ISMS context and risk: scope, interested parties, a climate change context assessment, risk methodology, a risk register and a Statement of Applicability covering every Annex A control.
- Controls and operations: control policies, suppliers, incident reporting, continuity, vulnerabilities, HR and training.
- Audit and findings: NIS 2, Regulation (EU) 2024/2690 and ISO/IEC 27001 audit checklists, corrective action, a regulatory finding response plan for supervisory requests and inspections, and an ISO/IEC 27001 certification roadmap. The certification decision rests with your chosen certification body.
- Worked examples using fictional organisations: a cloud provider, a managed service provider, a medium essential entity, a medium important entity and an organisation outside Regulation (EU) 2024/2690.
Who it's for
Essential and important entities under NIS 2, the relevant entities under Regulation (EU) 2024/2690, and organisations preparing for ISO/IEC 27001 certification. It suits the information security and compliance leads who run it and the consultants who support them.
If you need NIS 2 without a full ISMS, the NIS 2 Directive Cybersecurity Management System covers it. If you need an ISMS without NIS 2, see the ISMS ISO/IEC 27001:2022 toolkit.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in EU Compliance
See all 15
DORA ICT Risk & Digital Resilience Awareness Training Package
EU Compliance343 documents $550USD
NIS 2 Directive Cybersecurity Management System
EU Compliance305 documents $850USD
EU GDPR Website & E-Commerce Compliance Toolkit
EU Compliance283 documents $850USD