1. Is this a set of ready-to-use templates or a reference list?

Both. It's a complete register of all 146 documents with their regulatory mapping and ownership, plus full 22-field profiles for the 15 documents NIS2 makes mandatory and an Excel-ready master register. It's a template product, so you adapt each document to your entity before use.

2. Does downloading this make us NIS2 compliant?

No product can do that on its own. This gives you the documentation architecture and content that compliance depends on, but you still need to adopt, approve, populate and maintain the documents, and align them to your Member State's transposition law.

3. NIS2 is a directive — how does this handle national differences?

Article references are used as the directive-level anchor. Because each Member State's transposition law designates the competent authority, CSIRT and reporting channel and sets how the deadlines operate, the guide is explicit that you anchor exact obligations and wording to your national law.

4. What do the M, C and R status codes mean?

M = mandatory (explicitly required by NIS2, an implementing act or your national law — absence is a direct compliance gap). C = required in practice to evidence a mandatory obligation. R = recommended good practice drawn from ISO 27035, NIST SP 800-61 and supervisory expectations.

5. What format does the master register come in?

An Excel-ready CSV, pre-populated with all 146 documents across 18 columns. You import it into Excel, SharePoint or your GRC tool and maintain it as your single source of truth.

6. How does this help with the 24-hour and 72-hour deadlines?

The library is built around the NIS2 reporting clock and supplies the early warning, incident notification and final report templates as pre-approved blank forms — so they exist before an incident, when there's no time to design them.

7. We're a smaller entity — is 146 documents too much?

The guide includes adaptation guidance by entity type and size. The principle is to keep every mandatory (M) document, merge C documents into combined artefacts where sensible, and consolidate roles — without merging away the reporting obligations themselves.

8. How does this relate to GDPR and DORA?

One incident can trigger several regimes at once. The library includes privacy, legal and cross-regulatory documents to keep facts consistent across authorities, and notes that DORA is lex specialis for financial entities and displaces NIS2 incident reporting where it applies.

Is this a set of ready-to-use templates or a reference list?

Both. It is a complete register of all 146 documents with their regulatory mapping and ownership, plus full 22-field profiles for the 15 documents NIS2 makes mandatory and an Excel-ready master register. It is a template product, so you adapt each document to your entity before use.

Does downloading this make us NIS2 compliant?

No product can make an organisation NIS2 compliant on its own. The library provides the documentation architecture and content that compliance depends on, but you must still adopt, approve, populate and maintain the documents and align them with your Member State's transposition law.

NIS2 is a directive — how does this handle national differences?

NIS2 article references are used as the directive-level anchor. Each Member State's transposition law designates the competent authority, CSIRT and reporting channel and determines how the obligations and deadlines operate nationally. Exact obligations and document wording should therefore be aligned with the applicable national law.

What do the M, C and R status codes mean?

M means mandatory: explicitly required by NIS2, an implementing act or applicable national law, meaning its absence represents a direct compliance gap. C means required in practice to evidence a mandatory obligation. R means recommended good practice based on ISO 27035, NIST SP 800-61 and supervisory expectations.

What format does the master register come in?

The master register is supplied as an Excel-ready CSV pre-populated with all 146 documents across 18 columns. It can be imported into Excel, SharePoint or a GRC platform and maintained as a single source of truth.

How does this help with the 24-hour and 72-hour deadlines?

The library is built around the NIS2 reporting clock and includes the early warning, incident notification and final report templates as pre-approved blank forms. This means the necessary reporting documents exist before an incident, when there is no time to design them.

We're a smaller entity — is 146 documents too much?

The guide includes adaptation guidance according to entity type and size. The principle is to retain every mandatory document, merge practical-compliance documents into combined artefacts where appropriate, and consolidate roles without removing the underlying reporting obligations.

How does this relate to GDPR and DORA?

A single incident can trigger several regulatory regimes. The library includes privacy, legal and cross-regulatory documents designed to keep facts consistent across authorities. It also explains that DORA operates as lex specialis for relevant financial entities and takes precedence over NIS2 incident reporting where it applies.

Is this a set of ready-to-use templates or a reference list?

Both. It is a complete register of all 146 documents with their regulatory mapping and ownership, plus full 22-field profiles for the 15 documents NIS2 makes mandatory and an Excel-ready master register. It is a template product, so you adapt each document to your entity before use.

Does downloading this make us NIS2 compliant?

No product can make an organisation NIS2 compliant on its own. The library provides the documentation architecture and content that compliance depends on, but you must still adopt, approve, populate and maintain the documents and align them with your Member State's transposition law.

NIS2 is a directive — how does this handle national differences?

NIS2 article references are used as the directive-level anchor. Each Member State's transposition law designates the competent authority, CSIRT and reporting channel and determines how the obligations and deadlines operate nationally. Exact obligations and document wording should therefore be aligned with the applicable national law.

What do the M, C and R status codes mean?

M means mandatory: explicitly required by NIS2, an implementing act or applicable national law, meaning its absence represents a direct compliance gap. C means required in practice to evidence a mandatory obligation. R means recommended good practice based on ISO 27035, NIST SP 800-61 and supervisory expectations.

What format does the master register come in?

The master register is supplied as an Excel-ready CSV pre-populated with all 146 documents across 18 columns. It can be imported into Excel, SharePoint or a GRC platform and maintained as a single source of truth.

How does this help with the 24-hour and 72-hour deadlines?

The library is built around the NIS2 reporting clock and includes the early warning, incident notification and final report templates as pre-approved blank forms. This means the necessary reporting documents exist before an incident, when there is no time to design them.

We're a smaller entity — is 146 documents too much?

The guide includes adaptation guidance according to entity type and size. The principle is to retain every mandatory document, merge practical-compliance documents into combined artefacts where appropriate, and consolidate roles without removing the underlying reporting obligations.

How does this relate to GDPR and DORA?

A single incident can trigger several regulatory regimes. The library includes privacy, legal and cross-regulatory documents designed to keep facts consistent across authorities. It also explains that DORA operates as lex specialis for relevant financial entities and takes precedence over NIS2 incident reporting where it applies.

NIS2 Incident Response Document Library

Free and Immediately Usable NIS2 Incident Response Document Library

What is the NIS2 Incident Response Document Library?

The NIS2 Incident Response Document List & Document Library Register is the master inventory of every policy, procedure, register, checklist, form, playbook, evidence log and reporting template an essential or important entity needs to meet its incident response and reporting obligations under the NIS2 Directive (EU) 2022/2555.

Rather than starting from a blank page, you get a fully mapped documentation architecture: 146 documents organised into 13 categories, each one tied to the exact NIS2 article or implementing act it satisfies, with defined ownership, lifecycle position (before, during, or after an incident), a consistent numbering convention, and a recommended folder structure.

It is built around the reporting clock NIS2 actually enforces — the 24-hour early warning, 72-hour incident notification, and one-month final report — and it's designed to be imported straight into Excel, SharePoint or your GRC platform as a living single source of truth.

What's Inside?

146 documents	Across 13 categories — governance, intake & triage, significance assessment, regulatory reporting, response & recovery, evidence & audit, supply chain, business impact, communications, privacy & legal, root cause & remediation, testing & training, and registers & trackers.
Regulatory mapping	Every document tied to its NIS2 article or the relevant implementing act, plus adjacent regimes (GDPR, DORA, ISO 27035, NIST SP 800-61).
15 full document profiles	Deep specifications for the documents NIS2 makes mandatory — 22 fields each, covering purpose, owner, regulatory basis, lifecycle, contents and dependencies.
Master register (CSV)	An 18-column, Excel-ready register pre-populated with all 146 documents — import into Excel, SharePoint or your GRC tool.
Numbering convention	A structured NIS2-IR-[TYPE]-[NNN] scheme across 18 document types (policies, procedures, plans, forms, playbooks, logs, and more).
Recommended folder structure	A 16-folder architecture, including restricted closed-incident files and regulator submission folders with retention enforced.
Adaptation guidance	How to scale the library by entity type and size — including which documents to keep, merge or streamline.

Why Do You Need the NIS2 Document Library?

Under NIS2, responsibility for cybersecurity risk — incident response included — sits directly with the management body, and Article 21(2)(b) requires a documented incident management process. When a supervisor reviews you, the review almost always starts with your governance documents: without an approved policy, defined roles and controlled documents, nothing downstream can be evidenced.

The reporting deadlines make this urgent. Once you become aware of a significant incident, an early warning is due within 24 hours, a full notification within 72 hours, and a final report within one month — and missing a deadline is itself a sanctionable breach. Weak intake documentation is the single most common reason entities later can't prove they classified and reported on time.

This library closes that gap. It gives you the artefacts that demonstrate compliance is real and operational — not aspirational — so you're audit-ready before an incident and reporting-ready the moment one begins.

Key Benefits

Skip months of scoping work. The full document set, categories, ownership and regulatory mapping are already defined — you adapt, you don't invent.
Know exactly what's mandatory. Every document carries a status code — M (explicitly mandatory), C (required in practice to evidence compliance), or R (recommended good practice) — so you can prioritise the gaps that create direct compliance exposure.
Be ready before the clock starts. The documents you complete during an incident are supplied as pre-approved blank templates, because the 24-hour early warning window leaves no time to design forms.
Survive a supervisory review. Documents are mapped to Articles 20, 21, 23 and Implementing Regulation (EU) 2024/2690, so you can show an auditor the artefact behind each obligation.
Assemble evidence packs automatically. The folder structure mirrors the incident lifecycle, so a closed-incident file effectively builds its own regulatory evidence pack.
One controlled source of truth. The 18-column master register keeps ownership, versions, review dates and regulatory basis in a single maintained list.

Who is the NIS2 Document Library for?

CISOs and information security leaders responsible for building or maturing an incident response documentation set.
Compliance, risk and GRC teams who need to map controls to NIS2 articles and evidence them to a regulator.
Management bodies and executives carrying personal accountability for cybersecurity oversight under Article 20.
Essential and important entities across the sectors in NIS2 scope — as well as the DNS, cloud, data centre, managed service, marketplace and other digital providers named in Implementing Regulation (EU) 2024/2690.
Incident response, legal and communications teams who need pre-approved templates ready before an incident, not during one.
Consultants and virtual CISOs standing up NIS2 programmes for multiple clients who want a proven, adaptable baseline.

** GDPR & Privacy ** We wholeheartedly believe in your and our rights to privacy and in the GDPR. The bottom of the page explains how we use your data.

Please Fill the Form Below To Get Your Free Copy of the NIS2 Incident Response Document Library

Frequently Asked Questions about the NIS2 Incident Response Document Library

1. Is this a set of ready-to-use templates or a reference list?

Both. It's a complete register of all 146 documents with their regulatory mapping and ownership, plus full 22-field profiles for the 15 documents NIS2 makes mandatory and an Excel-ready master register. It's a template product, so you adapt each document to your entity before use.
2. Does downloading this make us NIS2 compliant?

No product can do that on its own. This gives you the documentation architecture and content that compliance depends on, but you still need to adopt, approve, populate and maintain the documents, and align them to your Member State's transposition law.
3. NIS2 is a directive — how does this handle national differences?

Article references are used as the directive-level anchor. Because each Member State's transposition law designates the competent authority, CSIRT and reporting channel and sets how the deadlines operate, the guide is explicit that you anchor exact obligations and wording to your national law.
4. What do the M, C and R status codes mean?

M = mandatory (explicitly required by NIS2, an implementing act or your national law — absence is a direct compliance gap). C = required in practice to evidence a mandatory obligation. R = recommended good practice drawn from ISO 27035, NIST SP 800-61 and supervisory expectations.
5. What format does the master register come in?

An Excel-ready CSV, pre-populated with all 146 documents across 18 columns. You import it into Excel, SharePoint or your GRC tool and maintain it as your single source of truth.
6. How does this help with the 24-hour and 72-hour deadlines?

The library is built around the NIS2 reporting clock and supplies the early warning, incident notification and final report templates as pre-approved blank forms — so they exist before an incident, when there's no time to design them.
7. We're a smaller entity — is 146 documents too much?

The guide includes adaptation guidance by entity type and size. The principle is to keep every mandatory (M) document, merge C documents into combined artefacts where sensible, and consolidate roles — without merging away the reporting obligations themselves.
8. How does this relate to GDPR and DORA?

One incident can trigger several regimes at once. The library includes privacy, legal and cross-regulatory documents to keep facts consistent across authorities, and notes that DORA is lex specialis for financial entities and displaces NIS2 incident reporting where it applies.

We are industry experienced practitioners when it comes to cyber security training & cyber security consultancy services

Training

We offer a host of courses including our NCSC Assured Training in Cyber Incident Planning and Response and our NCSC Assured Training in Building and Optimising Incident Response Playbooks.

Virtual CISO Services

Hands On, full-support 'Security As a Service', specifically designed for organisations that require access to experienced cybersecurity, governance, risk and compliance professionals.

Virtual Cyber Assistant

A unique, affordable, subscription-based, cybersecurity service for small to medium businesses, offering 280+ services in cybersecurity.

Cyber Crisis Tabletop Exercises

Scenario-based, verbally-simulated tabletop attack exercises that test your organisation's ability to effectively respond to a cyber-attack.

Ransomware Tabletop Exercise

Measure your organisation’s Ransomware Readiness with a unique blend of verbal and visual simulations and ransomware scenario walkthroughs.

Executive Cyber Awareness Sessions

Specially designed for executive management, CEOs and boards of directors, engaging them in a business context to help explain the threats and risks from cyber-attacks.

How we use your data:

Contact you about our services including, but not limited to, training, trusted advisory and consultancy.
Keep you posted on free resources and documents.
Update you on upcoming webinars and surveys.
Update you when we host our ground-breaking Wisdom of Crowds events.
Ask you, every now and then, if you want to take part in crowdsourced initiatives.
Our partners (we carefully select our partners) may contact you to arrange or demo or share more information with you about their products or services when you watch one of our sponsored webinars. Remember, you can always tell us or our partners, "No, not interested".