The NIS 2 Directive (EU 2022/2555) is the EU's updated cybersecurity legislation, significantly expanding the scope and requirements of the original NIS Directive. It mandates comprehensive risk management, incident reporting within 24 hours, supply chain security, and management accountability for essential and important entities across 18 sectors.
Essential and important entities operating in the EU across energy, transport, health, digital infrastructure, ICT services, and more.
10 policies required for NIS 2 Directive compliance, organized by category.
Establishes a systematic approach to identifying, analyzing, and treating cybersecurity risks in accordance with NIS 2 Directive Article 21.
Defines procedures for detecting, managing, and reporting significant cybersecurity incidents, including the mandatory 24-hour early warning to the CSIRT under NIS 2 Article 23.
Addresses security requirements for direct suppliers and service providers, aligned with NIS 2 Article 21(2)(d).
Establishes access control policies and asset management requirements for network and information systems, aligned with NIS 2 Article 21(2)(i).
Defines requirements for multi-factor authentication and continuous authentication solutions, aligned with NIS 2 Article 21(2)(j).
Ensures continuity of essential or important services during and after cybersecurity incidents, aligned with NIS 2 Article 21(2)(c).
Establishes governance structures and management body responsibilities for cybersecurity oversight, aligned with NIS 2 Article 20.
Establishes security controls for network and information systems acquisition, development, and maintenance, aligned with NIS 2 Article 21(2)(e).
Establishes procedures for vulnerability disclosure and coordinated handling of vulnerabilities, aligned with NIS 2 Article 21(2)(e) and Article 12.
Defines policies and procedures for the use of cryptography and encryption to protect network and information systems, aligned with NIS 2 Article 21(2)(h).
Answer questions about your infrastructure and PoliWriter generates all 10 NIS 2 Directive policies customized to your organization. Audit-ready in hours, not months.
Get Started FreeNo credit card required. 3 documents free.
Service Organization Control 2 - Trust Services Criteria covering Security, Availability, Processing Integrity, Confidentiality, and Privacy. Requires an observation period of 3-12 months demonstrating controls operate effectively over time.
22 templatesGeneral Data Protection Regulation - EU data protection and privacy regulation.
10 templatesHealth Insurance Portability and Accountability Act - US healthcare data protection.
12 templatesInternational standard for information security management systems (ISMS).
11 templatesPayment Card Industry Data Security Standard — security controls for organizations that store, process, or transmit payment cardholder data.
12 templatesCalifornia Consumer Privacy Act / California Privacy Rights Act — grants California consumers rights over their personal information collected by businesses.
8 templatesNIST Cybersecurity Framework — voluntary guidance for managing cybersecurity risk across five core functions: Identify, Protect, Detect, Respond, and Recover.
10 templatesSOC 2 Type I — Point-in-time assessment of your security controls design. Ideal for first-time certification before progressing to Type II.
22 templatesISO/IEC 42001 — International standard for Artificial Intelligence Management Systems (AIMS), covering responsible AI development, deployment, and governance.
8 templatesNIST SP 800-53 — Comprehensive catalog of security and privacy controls for federal information systems, widely adopted by private sector organizations.
10 templates