NIS2 does not list a fixed set of documents. Article 21(2) names ten measure areas, several of them as policies, and Articles 20 and 23 add management approval and incident reporting duties. A practical document set is one policy or procedure per area, board approval records, a supplier register and a reporting playbook.
We read Directive (EU) 2022/2555 on EUR-Lex on 18 October 2026. National laws that transpose it may add or change documentation duties, so check yours and your authority's guidance. This is not legal advice.
Which documents map to Article 21(2)?
- (a) risk analysis and information system security policies: Risk management policy, risk register and method, information security policy
- (b) incident handling: Incident response procedure, severity classification, log of incidents
- (c) business continuity, backups, disaster recovery, crisis management: Continuity plan, backup procedure, recovery test records, crisis communication plan
- (d) supply chain security: Supplier security policy, supplier register, contract clauses, supplier reviews
- (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure: Secure development and change policy, vulnerability management procedure, disclosure contact process
- (f) assessing effectiveness of measures: Audit and testing plan, test results, management reports
- (g) cyber hygiene and training: Training plan, completion records, baseline hygiene standard
- (h) cryptography and encryption: Cryptography policy, key management procedure
- (i) human resources security, access control, asset management: Joiner and leaver procedure, access control policy, asset inventory
- (j) multi-factor or continuous authentication, secured communications, emergency communications: Authentication standard, secure communications rules, emergency contact plan
The directive says measures must follow an all-hazards approach, so risk documents should cover more than cyber attack, for example physical events and loss of suppliers.
What does management need to produce?
Article 20 says management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements, and members must receive training. Keep:
- Minutes or signed approvals of the policy set.
- Records of management training.
- Periodic reports showing oversight, such as risk and incident summaries.
What does incident reporting need on paper?
Article 23(4) sets significant incident deadlines: early warning within 24 hours of awareness, incident notification within 72 hours, an intermediate report on request, and a final report no later than one month after the notification. Prepare:
- A definition of significant incident that follows your national rules.
- A decision tree and named people who can authorize filing.
- Templates for each of the three reports.
- Contact details for your competent authority or CSIRT.
- A timeline log showing when you became aware and when you filed.
How do you keep the set manageable?
Combine topics where the content overlaps, such as access control with joiner and leaver steps. Give each document an owner, approval date and review date. Keep policies short and link to procedures and records. A twelve page policy no one reads fails the purpose.
What to do
- Create the ten row table above and mark what exists.
- Draft missing policies in plain language, owner by owner.
- Add the supplier register and contract clause library.
- Write the incident reporting playbook with the three deadlines.
- Get management approval and training on record.
- Set a yearly review and a trigger list for earlier revision, such as a major incident or new service.
Quick check
Does NIS2 give a mandatory list of policies?
No. Article 21(2) names areas that measures must cover. Several are phrased as policies, but you decide the document structure unless your national law says otherwise.
Who must approve the measures?
Under Article 20, the management bodies of essential and important entities approve the cybersecurity risk-management measures and oversee their implementation.
How Safeguard helps automate this
Documents only count if the practice behind them is real, and some of that practice is technical. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, leaving the team time for other work. Technical evidence for vulnerability handling and secure development comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard does not make you NIS2 compliant. Book a call to see it.
Sources
- EUR-Lex: Directive (EU) 2022/2555 (NIS2), fetched 18 October 2026 (Articles 20, 21, 23)
Last reviewed: 18 October 2026.
