Digital download
NIS2 Small-Entity Compliance Kit
Fifteen editable Word documents and two Excel workbooks. Together they give a small organisation the written policies, procedures, registers and incident templates that NIS2 Article 21 asks for. They are written for a company with one person looking after IT part time, not a security department.
One payment, no subscription. As soon as you have paid, Polar emails you a link to the download, a ZIP file of about 600 KB. Polar is our merchant of record: it takes the payment and adds VAT where it applies.
1. Who it is for
- Small and medium-sized organisations that fall under NIS2 as an important entity.
- Suppliers to NIS2 entities who are being sent security questionnaires. Your customers must manage the security of their supply chain, so they will ask you for evidence.
- Anyone who wants a written security baseline without hiring a consultant.
Not sure whether NIS2 applies to you? Our free guide Does NIS2 apply to your business? explains the sector and size tests in the Directive, and the Scope Check sheet takes you through them. Your national authority or a lawyer has the final word.
2. What is in the kit
Every file is editable. Most documents run to three or four pages and none is longer than six. Text you need to replace is highlighted in yellow and in [square brackets].
| File | What it gives you |
|---|---|
| 00 Read Me First | How to use the kit in thirty days, and a short guide to NIS2, CyberFundamentals and ISO 27001. |
| 03 Information Security Policy | The top-level policy your management body signs: scope, roles and legal basis. |
| 04 Risk Management Procedure | How to run a two-hour risk workshop and keep the risk register up to date. |
| 05 Asset Management Policy | What to list, how to classify it and how to dispose of it. |
| 06 Access Control and Authentication Policy | Accounts, multi-factor authentication, privileged access, remote and physical access, joiners and leavers. |
| 07 Acceptable Use and Cyber Hygiene Policy | Ten rules that every member of staff reads and signs. |
| 08 Awareness, Training and HR Security Plan | Yearly training, the management body's own training under Article 20, screening, joining and leaving. |
| 09 Patch, Vulnerability and Secure Configuration Procedure | Patch timescales, malware protection, a hardening baseline and change control. |
| 10 Logging and Monitoring Procedure | Which logs to keep, for how long, and the five alerts to act on. |
| 11 Backup and Business Continuity Policy | The 3-2-1-1 backup rule, restore tests, crisis roles and a recovery runbook. |
| 12 Incident Response Plan | Roles, a severity scale, first-hour playbooks, a NIS2 and GDPR decision tree, a tabletop exercise and holding statements. |
| 12c NIS2 Incident Notification Templates | Pre-written early warning (24 hours), incident notification (72 hours), final report (one month) and a notice to the people who use your services. |
| 13 Supplier Security Policy | Supplier tiers, eleven contract clauses and a twelve-question supplier questionnaire. |
| 14 Cryptography and Data Protection Policy | Encryption at rest and in transit, key handling and approved algorithms. |
| 15 Management Review Minutes Template | The yearly meeting that shows your management body oversees security. |
| NIS2 Registers (Excel) | Risk Register, Asset Register, Supplier Register, Incident Log, Training Log and Access Review Log, with drop-down lists and example rows. |
| NIS2 Compliance Tracker (Excel) | Scope Check, 30-Day Plan, Control Mapping, Internal Audit Checklist and Evidence Checklist. |
The ZIP also holds a plain-text copy of the Read Me. The files open in Microsoft Word and Excel, LibreOffice, and Google Docs and Sheets.
3. How it is mapped
Each policy and procedure starts with a document control table. It names the owner, the approver and the next review date. It also lists the NIS2 articles, the CyberFundamentals (CyFun) controls and the ISO/IEC 27001:2022 controls that the document covers. Most documents end with a list of the evidence to keep.
The Control Mapping sheet in the Compliance Tracker lists 33 CyFun controls, using the control codes of the 2023 edition. Each row gives the NIS2 Article 21(2) measure, the ISO/IEC 27001:2022 reference and the kit document that covers it. As you work, you record the status, where the evidence is kept and any gap. The sheet then serves as a simple statement of applicability. It does not cover all 93 ISO 27001 Annex A controls.
The kit was written with Belgium in mind. It includes the Belgian details: registration on Safeonweb@Work and the Centre for Cybersecurity Belgium (CCB) as the authority you notify. The policies follow the Directive itself, so they also work in other EU countries. Where national rules differ, such as the authority or the registration portal, the documents tell you what to check.
4. Using it in thirty days
- Complete the Scope Check in the Compliance Tracker and record your conclusion.
- Follow the 30-Day Plan. It puts the work in order: governance first, then your inventory, then the key measures (multi-factor authentication, backups, patching, logging and training), then incident readiness.
- Edit each document. Replace the highlighted placeholders and delete what does not apply to you.
- Have your management body approve and sign the Information Security Policy. Under NIS2 Article 20 it is responsible for approving and overseeing the measures.
- Fill in the Control Mapping as you go, and keep the evidence listed in the Evidence Checklist.
The kit's own estimate is 25 to 40 hours of work in total, spread over the month.
5. What it is not
- Not legal advice. It is based on Directive (EU) 2022/2555. It does not replace reading your national law.
- Not compliance in a box. The documents only count once you put the measures in place and keep the evidence. The Evidence Checklist lists what to collect.
- Not a full management system. Essential entities preparing for CyFun Essential or ISO 27001 certification need more than this starter set.
- Not a set of product guides. It says what to do, not which settings to change in a particular product.
- English only. There is no Dutch or French version yet.
6. Licence, updates and refunds
One licence covers one organisation. You can edit and rebrand the documents, use them inside your organisation, and share them with your auditors, verifiers, customers and suppliers. You cannot resell or publish the kit, or use it to supply templates to other organisations. To use it for several organisations, for example as a managed service provider, email us before you buy.
Updates to version 1.x are free for one year from purchase.
If the kit is faulty or not as described, email us within 30 days and we will fix it, replace it or refund you. Because the kit is a download supplied straight away, the 14-day cancellation right for consumers ends once the download begins. The refund section of our terms has the details.
7. After you buy
Polar emails you an order confirmation with a link to your download. You can download the kit again at any time from Polar's customer portal at polar.sh/tagnator/portal. Sign in there with the email address you paid with.
Start with 00 Read Me First, then open the Scope Check in the Compliance Tracker.
For help, email support@tagnator.com with your order number. We reply within two working days. Polar handles your payment details; what we receive and keep is in the compliance kit section of our privacy policy.
8. Questions
Which CyberFundamentals edition does it use?
The 2023 edition. Its control codes follow NIST CSF 1.1, such as ID.AM-1 or PR.AC-1. The kit does not yet use the CyFun 2025 codes.
Can we rebrand it?
Yes. Replace [Organisation] and the role names, add your logo, and delete what does not apply.
Will it get us certified?
Not by itself. It gives you the documents and registers that a verifier or a customer asks to see. Certification also needs evidence that the controls work in practice.
Can I read about NIS2 before I buy?
Yes. Our free guides cover whether NIS2 applies to you, the ten Article 21 measures and incident reporting deadlines, with links to the Directive's text.
Something else?
Email support@tagnator.com. We are happy to answer questions before you buy.