About Us Contact Blog
Governance DocsGovernance Docs
Which Toolkit?SoA GeneratorFree TemplatesSample ReportsFind the Right AssessmentRecords of Processing (ROPA)Data Privacy Impact AssessmentLegitimate Interests AssessmentTransfer Impact AssessmentPrivacy Risk AssessmentGDPR Gap AssessmentUK GDPR Gap AssessmentCCPA/CPRA Gap AssessmentISO 27701 Gap AssessmentHIPAA Gap AssessmentISO 27001 Risk AssessmentThird-Party Risk AssessmentSoA GeneratorISO 27001 Assessment Tool (Excel)ISO 27001 Gap AssessmentSOC 2 Gap AssessmentNIST CSF 2.0 Gap AssessmentNIST SP 800-53 Gap AssessmentNIST RMF Gap AssessmentCIS Controls Gap AssessmentPCI DSS 4.0 Gap AssessmentNIS2 Gap AssessmentCMMC 2.0 Gap AssessmentNIST SP 800-171 Gap AssessmentFedRAMP Gap AssessmentBSI C5 Gap AssessmentIEC 62443 Gap AssessmentSAMA CSF Gap AssessmentNCA ECC Gap AssessmentISO 20000 Gap AssessmentAI Risk AssessmentAI Impact AssessmentISO 42001 Gap AssessmentEU AI Act Gap AssessmentBusiness Impact AnalysisContinuity Risk AssessmentISO 22301 Assessment Tool (Excel)ISO 22301 Gap AssessmentDORA Gap AssessmentISO 9001 Gap AssessmentISO 13485 Gap AssessmentIATF 16949 Gap AssessmentISO 14001 Gap AssessmentISO 45001 Gap AssessmentISO 45001 Assessment Tool (Excel)HACCP Gap AssessmentEnterprise Risk AssessmentISO 31000 Gap AssessmentData Governance Gap AssessmentProject Management Gap AssessmentAll Gap AssessmentsISO 27001 Internal AuditISO 42001 Internal AuditAboutBlogContactMy AccountCart
Browse Toolkits
Governance Docs
  • Browse All Toolkits
  • Information Security & Cybersecurity
  • Data Privacy & Protection
  • Governance, Risk & Compliance
  • Quality Management
  • Health, Safety & Environment
  • AI Governance
My Account

CART

No products in the cart.

Category: NIS2

The NIS2 Directive is EU cybersecurity legislation covering essential and important entities across eighteen sectors. As a Directive it is transposed into national law by each member state, so the detail — and the penalties — vary by country. The transposition deadline was 17 October 2024.
It widened the original NIS Directive substantially, both in the sectors covered and in what is required. Article 21 sets out risk-management measures spanning risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and more.
Two features distinguish NIS2 from what came before. Management bodies must approve and oversee cybersecurity measures and can be held personally liable, which moves the conversation into the boardroom. And reporting is fast: an early warning within 24 hours, a fuller notification within 72 hours, and a final report within one month.
An ISO 27001 ISMS covers a large share of the Article 21 measures and is the most efficient way to build the evidence — but NIS2 compliance is a legal determination made by your national authority, not something a certificate confers.
The guides below cover what NIS2 requires, who is in scope, the penalties and deadlines, and how it compares with ISO 27001 and DORA.

CRA vs NIS2 explained

CRA vs NIS2: 7 Clear Differences Explained for 2026

Governance Docs19th September 2026

CRA vs NIS2: products vs entities, Article 14 vs Article 23 clocks, EUR 15m/2.5% vs EUR 10m/2% fines,…
Read More
NIS2 incident reporting explained

NIS2 Incident Reporting: A Clear Guide to the 3 Deadlines

Governance Docs17th September 2026

NIS2 incident reporting under Article 23: 24-hour early warning, 72-hour notification, one-month final report, and the thresholds in…
Read More
NIS2 penalties for essential and important entities plus management liability and deadlines

NIS2 Penalties & Deadlines Explained

Governance Docs17th July 2026

NIS2 penalties are among the toughest in EU cyber law, with personal liability for management. Here are the…
Read More
NIS2 vs ISO 27001 - how the cybersecurity law and the information security standard align

NIS2 vs ISO 27001: Use Your ISMS to Comply

Governance Docs17th July 2026

NIS2 vs ISO 27001: one is a mandatory law, the other a certifiable standard. Here is how they…
Read More
Who does NIS2 apply to - essential and important entities and the sectors NIS2 covers

Who Does NIS2 Apply To? Essential vs. Important Entities

Governance Docs17th July 2026

NIS2 widened EU cybersecurity rules to thousands of new organizations. Learn who is covered, the essential vs important…
Read More
NIS2 requirements checklist covering security measures, incident reporting and documentation

NIS2 Requirements & Documentation Checklist

Governance Docs17th July 2026

What does NIS2 actually require? A practical checklist of the security measures, incident-reporting timelines, and documentation your organization…
Read More
DORA vs NIS2 comparison of the financial-sector regulation and the cross-sector cybersecurity directive

DORA vs NIS2: How They Overlap for Financial Firms

Governance Docs17th July 2026

DORA vs NIS2: one is a financial-sector regulation, the other a cross-sector directive. Here are the key differences…
Read More
NIS2 directive explained - scope, security requirements, incident reporting and penalties

NIS2 Directive Explained: A Complete Compliance Guide

Governance Docs20th May 2026

The NIS2 Directive is the EU's most far-reaching cybersecurity law. A complete guide to its scope, security requirements,…
Read More

Recent Posts

ISO 45001 surveillance audit requirements for 2026: annual frequency, the 12-month deadline, one third of initial audit time, and the on-site rule
ISO 45001 Surveillance Audit: The Complete 2026 Guide

November 4, 2026

ISO 14001 surveillance audit infographic showing the cycle years, audit time, eight review areas and the 2029 transition deadline
ISO 14001 Surveillance Audit: The Complete 2026 Guide

November 3, 2026

ISO 27001 toolkit contents shown as three layers: clause 4 to 10 records, 93 Annex A controls and supporting registers
ISO 27001 Toolkit: What a Complete One Contains (2026)

November 2, 2026

ISO 9001 recertification audit three-year cycle showing surveillance in years 1 and 2 and recertification in year 3
ISO 9001 Recertification Audit: The Complete 2026 Guide

November 1, 2026

ISO 9001 surveillance audit: eight required review areas, the 12-month window and the 2029 transition deadline
ISO 9001 Surveillance Audit: The Complete 2026 Guide

October 31, 2026

Categories

  • Articles
  • DORA
  • GDPR
  • HIPAA
  • ISO 27001
  • ISO 42001 & AI governance
  • ISO 9001
  • Management systems
  • NIS2
  • Security frameworks
  • SOC 2
Governance DocsGovernance Docs

Reliable ISO & compliance documentation toolkits that help your business meet regulatory standards with ease.

Governance Docs LLC
1209 Mountain Road Pl NE, Suite R
Albuquerque, NM 87110, USA
[email protected]
+1 505 289 2455

Toolkits

  • ISO 27001:2022
  • GDPR
  • SOC 2
  • PCI-DSS v4.0
  • HIPAA
  • ISO 42001
  • All toolkits →

Company

  • About Us
  • Blog
  • Contact
  • FAQ
  • Which toolkit do I need?
  • Request a custom toolkit
  • Free templates
  • SoA generator
  • Assessments
  • Sample reports
  • RSS feeds

Policies

  • Privacy Policy
  • Terms & Conditions
  • Refund & Return Policy
  • Delivery Policy
  • Manage cookies
Browse by topicISO 27001ISO 42001 & AI governanceGDPRSOC 2HIPAANIS2DORAISO 9001Management systemsSecurity frameworks
© 2026 Governance Docs LLC. All rights reserved.
Secure checkoutstripeVISA