NIS2 Templates: 72 Documents for Every Obligation

Main article: NIS2 Guide 2026 — obligations, fines and roadmap at a glance. This page is the document map that goes with it: which template evidences which obligation and in which order you build them up. All articles on the topic can be found in the NIS2 knowledge area.

Legal basis: which templates do Art. 21, 22 and 23 NIS2 Directive require?

The NIS2 Directive (Directive (EU) 2022/2555) does not set out a list of documents but measure areas whose implementation the entity must be able to evidence. In Germany, the BSI Act (BSIG) applies as amended by the NIS2 Implementation Act (NIS2UmsuCG) (BGBl. 2025 I No. 301), in force since 6 December 2025 and last amended by Art. 8(1) of the Act of 23 July 2026 (BGBl. 2026 I No. 226).

Art. 21 NIS2 Directive and § 30 BSIG: risk management

Art. 21(1) requires appropriate and proportionate technical, operational and organisational measures; paragraph 2 names ten minimum areas (points (a) to (j)), which § 30(2) nos. 1 to 10 BSIG adopts for particularly important and important entities. Decisive for the templates is § 30(1) sentence 3 BSIG: compliance with the obligation must be documented by the entities. The management must implement the measures and monitor their implementation (§ 38(1) BSIG). All ten obligations in one table: § 30 BSIG: all 10 obligations in one table.

Art. 22 NIS2 Directive: coordinated risk assessments of the supply chain

Art. 22 is not addressed to the entities: the Cooperation Group, together with the Commission and ENISA, may carry out coordinated risk assessments of specific critical ICT services, ICT systems or ICT products (Art. 22(1)). The entities must take the results into account in their supply-chain measures (Art. 21(3)). No separate documentation obligation follows from this; the reference belongs in the supply-chain policy and the supplier assessment. Deep dive: NIS2 supply-chain security and the supplier audit questionnaire with 40 questions.

Art. 23 NIS2 Directive and § 32 BSIG: reporting obligations

In the event of a significant security incident, particularly important and important entities in Germany report to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK): an early initial report within 24 hours of becoming aware, a report with an initial assessment within 72 hours, an intermediate report on request and a final report no later than one month after the 72-hour report; where the incident is still ongoing, a progress report comes first (§ 32(1) BSIG). The obligation applies at the earliest from the point at which the reporting channel has been set up. In practice this requires predefined reporting channels, a template for each stage and an incident response plan. The procedure in detail: NIS2 reporting channels and incident documentation.

The 72 documents at a glance

The table follows the actual folder structure of the NIS2 Kit (version for Germany). The numbers are the document numbers in the kit, the same as in the preview on the kit page. The column "Reference" names the provision whose implementation the document evidences.

The NIS2 Kit is available as a version for Germany (BSIG) or for Austria (NISG 2026) in three packages: Basic with 66 documents for EUR 990, Plus with training pack for EUR 1,390 (72 documents) and Complete with the additional Cybersecurity e-learning as HTML and SCORM 1.2/2004 for EUR 1,690. All prices net and one-off, 12 months of legal-status updates included. The kit is sold to businesses only (B2B).

§ 30 BSIG: the 10 measure areas — quick reference

The ten areas of § 30(2) BSIG appear in the column "Reference" of the table. Folders 03 to 10 each cover one or more areas; folder 10 bundles cryptography (no. 8), personnel, access and asset inventory (no. 9) as well as MFA and secured communication (no. 10). What each area requires in substance and how it maps onto ISO 27001 is explained in § 30 BSIG: 10 mandatory NIS2 measures. The methodology of the risk analysis under point (a) is covered in depth by the NIS2 risk management template.

Do particularly important and important entities need different documentation?

No, the same measures under § 30 BSIG apply to both. "Essential entity" is the term used in the Directive; the BSIG speaks of particularly important entities, which also include operators of critical installations (§ 28(1) BSIG), and of important entities (§ 28(2) BSIG). The difference lies in the supervisory regime: the BSI may order individual particularly important entities to undergo audits, inspections or certifications by independent bodies (§ 61(1) BSIG) and may require evidence from other particularly important entities at the earliest three years after the Act entered into force (§ 61(3) BSIG); for important entities, the BSI only carries out checks where facts indicate infringements (§ 62 BSIG). The BSIG does not provide for an annual self-declaration. Operators of critical installations additionally meet the special requirements of § 31 BSIG and provide evidence of implementation every three years (§ 39(1) BSIG); their registration with the BBK under § 8 of the KRITIS Umbrella Act (KRITISDachG, in force since 17 March 2026) is only governed procedurally once the statutory ordinance under § 4(3) and § 5(1) KRITISDachG has entered into force — until then the reservation of application in § 66 BSIG applies. Whether and how you are affected is clarified by NIS2 implementation in Germany and NIS2 for small enterprises with 50 to 100 employees; fines and liability are covered in the NIS2 Guide.

Prioritisation: which templates when?

The day figures are practice rhythms for building up the documentation, not statutory deadlines. By contrast, the registration within three months (§ 33(1) BSIG; the BSI points out that the statutory registration deadline has already expired) and the reporting deadlines under § 32 BSIG are laid down by law. The complete project plan with policies, audit and management review is described in Build an ISMS for NIS2.

Days 1–30: recommended starter set

For the registration itself, the Act prescribes no documents; what is submitted is master data such as the name, contact details, sector under Annex 1 or 2, the EU Member States concerned and the competent supervisory authorities (§ 33(1) BSIG). Five building blocks are recommended as the basis for everything that follows:

• Scope assessment and registration form pre-fill (04, 05)
• Asset inventory with systems, data, cloud services and responsible persons (47)
• Information security policy, approved by the management (16)
• Risk assessment matrix in a first version (18)
• Incident response playbook with report template for the 24-hour report (21, 22)

In addition, the board resolution (09), with which the management records implementation and monitoring under § 38(1) BSIG.

Days 31–60: quick wins under § 30 BSIG

See NIS2 Top-7 Quick Wins: MFA rollout, backup concept, patch management, phishing training, supplier inventory, IRP tabletop, asset classification. The matching templates are 48, 30, 38, 42 and 43, 34 and 35, 21 as well as 47.

Days 61–90: audit-capable documentation

• Statement of Applicability (52) and gap analysis (51)
• Effectiveness assessment per measure (40, 41)
• Cryptography concept (44)
• Supplier assessment and contract clauses (35, 36)
• Business continuity policy and disaster recovery plan with a first exercise (29, 31); details in the disaster recovery plan template

Days 91–180: ISO 27001 or equivalent

Those aiming for certification use the gap mappings (58, 59) and add risk treatment, internal audits and continuous improvement. Pathway: NIS2 and ISO 27001 certification.

Updating and versioning

NIS2 templates are not one-off documents. The measures must be effective and should comply with the state of the art (§ 30(1) and (2) BSIG); outdated documentation does not evidence that.

• Annual review (practitioner recommendation): information security policy, risk assessment, incident response playbook, business continuity policy, supplier inventory, asset inventory
• Event-driven: after every significant security incident (§ 32 BSIG), on material IT changes, new threat situations and after audit findings
• Versioning: document control with version number, release date, approving person and change history
• Retention: § 38 BSIG contains no retention or limitation period; members of the management are liable to their entity under the company law of its legal form (§ 38(2) BSIG). Training records and incident reports should therefore be kept under an internal retention concept that is guided by the company-law limitation periods for directors' liability.

How often the risk analysis itself must be repeated is covered by the risk management template; how to compile the documentation for an audit is covered by the audit preparation for the supervisory authority.

Austria: NISG 2026 instead of the BSIG

Austria (AT): in Austria the NISG 2026 (BGBl. I No. 94/2025) applies; §§ 2 to 45 have been in force since 1 October 2026 (§ 51(2) NISG 2026). The competent authority is the Federal Office for Cybersecurity. The terms are those of the Directive: essential and important entities (§ 24 NISG 2026). The document map stays the same, the references change: risk management under § 32(4)(a) to (j), management bodies under § 31, reports to the competent CSIRT under § 34 (24 hours, 72 hours, one month), registration with the Cybersecurity Authority under § 29 within three months of entry into force. Unlike in Germany, there is a self-declaration: within twelve months of the registration obligation arising, the entities submit information on their risk-management measures, and on request evidence by an independent body follows (§ 33 NISG 2026). Fines under § 45 NISG 2026 reach up to EUR 10 million or 2% (essential) or EUR 7 million or 1.4% of worldwide annual turnover (important entities), whichever amount is higher. The kit is therefore available as a separate version for Austria. More: NIS2 Austria (NISG 2026).