NIS2 template · NIS 2 Directive
Incident Handling & Reporting Policy
Defines procedures for detecting, managing, and reporting significant cybersecurity incidents, including the mandatory 24-hour early warning to the CSIRT under NIS 2 Article 23. Written for your company, citing the controls below.
- Sections
- 8
- Controls cited
- 8
- Formats
- PDF, Word
- Shelf
- 10 NIS2documents in all
No card needed to start.
NIS28 sections
Incident Handling & Reporting PolicyDefines procedures for detecting, managing, and reporting significant cybersecurity incidents, including the mandatory 24-hour early warning to the CSIRT under NIS 2 Article 23.
- Cites
- Art. 21.2b, Art. 23, SOC 2 CC7.3 and 5 more
- Formats
- PDF and Word
NIS2 shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Incident Classification
- Detection and Initial Response
- 24-Hour Early Warning
- 72-Hour Incident Notification
- Containment, Eradication, and Recovery
- Final Report and Lessons Learned
- Roles and Responsibilities
Controls it cites
The NIS2 controls first, then the matching controls in other frameworks.
- Art. 21.2bIncident HandlingNIS2
- Art. 23Incident ReportingNIS2
- SOC 2 CC7.3System Operations: Incident ResponseSOC 2
- SOC 2 CC7.4System Operations: Incident HandlingSOC 2
- ISO A.5.24Incident Management PlanningISO 27001
- HIPAA §164.308(a)(6)Security Incident ProceduresHIPAA
- CSF RS.MA-1Incident ManagementNIST CSF
- 800-53 IR-1Incident ResponseNIST 800-53
- NIS27 sections
Business Continuity & Crisis Management Policy
CitesArt. 21.2c SOC 2 A1.1 SOC 2 A1.2 +6 +7PDF · WordCites Art. 21.2c, Business Continuity (NIS2); SOC 2 A1.1, Availability: Capacity Planning (SOC 2); SOC 2 A1.2, Availability: Recovery (SOC 2), and 6 more. - NIS27 sections
Supply Chain Security Policy
CitesArt. 21.2d SOC 2 CC9.2 ISO A.5.19 +4 +5PDF · WordCites Art. 21.2d, Supply Chain Security (NIS2); SOC 2 CC9.2, Risk Mitigation: Vendor & Business Partner (SOC 2); ISO A.5.19, Information Security in Supplier Relationships (ISO 27001), and 4 more. - NIS27 sections
Network & Information Systems Security Policy
CitesArt. 21.2e SOC 2 CC6.6 SOC 2 CC6.7 +4 +5PDF · WordCites Art. 21.2e, Network Security (NIS2); SOC 2 CC6.6, Logical & Physical Access: External Threats (SOC 2); SOC 2 CC6.7, Logical & Physical Access: Transmission Security (SOC 2), and 4 more. - NIS26 sections
Vulnerability Disclosure & Patch Management Policy
CitesArt. 21.2f Art. 21.2g SOC 2 CC7.1 +4 +5PDF · WordCites Art. 21.2f, Vulnerability Handling (NIS2); Art. 21.2g, Security Assessment (NIS2); SOC 2 CC7.1, System Operations: Detection Mechanisms (SOC 2), and 4 more. - NIS27 sections
Cryptography & Encryption Policy
CitesArt. 21.2h SOC 2 CC6.7 ISO A.8.24 +6 +7PDF · WordCites Art. 21.2h, Cryptography (NIS2); SOC 2 CC6.7, Logical & Physical Access: Transmission Security (SOC 2); ISO A.8.24, Use of Cryptography (ISO 27001), and 6 more. - NIS27 sections
Access Control & Authentication Policy
CitesArt. 21.2j Art. 21.2i SOC 2 CC6.1 +8 +9PDF · WordCites Art. 21.2j, Access Control (NIS2); Art. 21.2i, HR Security (NIS2); SOC 2 CC6.1, Logical & Physical Access: Security Software (SOC 2), and 8 more.
NIS2 on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIS2 + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.