NIS2 documents: which documentation your company needs
NIS2 requires you to document your security measures (§ 30(1), third sentence, BSIG). The law explicitly asks for “policies” (Konzepte) for risk analysis and IT security, checking effectiveness, cryptography, and staff, access and IT management. For the rest, a list is often enough. The law does not prescribe a format.
What the law requires
Essential and important entities take measures in ten areas (§ 30(2) BSIG). They put in writing that they do so (§ 30(1), third sentence, BSIG).
For four areas the law explicitly speaks of policies: risk analysis and IT security (no. 1), assessing effectiveness (no. 6), cryptography (no. 8), and staff, access control and IT management (no. 9).
The law does not set what the documents look like, how long they are or which software you keep them in. They follow your company's risk, size and costs (§ 30(1), second sentence, BSIG).
§ 30(1) and (2) BSIG · Art. 21 NIS 2
The documents at a glance
These six documents cover the areas where a written text makes sense. Management approves each one.
| Document | What it says |
|---|---|
| Information security policy§ 30(2) no. 1 | How your company handles information security: goals, responsibilities, how risks are assessed. |
| Incident response plan§ 30(2) no. 2 | Who decides in an incident, whom you call, how you reach each other without IT and how you report to the BSI. |
| Business continuity plan§ 30(2) no. 3 | What has to keep running when IT fails, and how you restore operations. |
| Rules for buying, maintenance and vulnerabilities§ 30(2) no. 5 | What you look for when buying IT, how updates are installed and where others can report vulnerabilities they find. |
| Cryptography policy§ 30(2) no. 8 | Where and how you encrypt, for example laptops, email and remote access. |
| Staff, access and IT management policy§ 30(2) no. 9 | Who gets which access, how new people receive it and leavers lose it, and how you manage your IT. |
Where a list is enough
For other areas you do not need running text. A list you keep up to date shows what you do.
| List | What it says |
|---|---|
| Your assets§ 30(2) nos. 1 and 9 | What your company works with: processes, software, devices, rooms, networks, and who supplies them. |
| Your suppliers§ 30(2) no. 4 | Who works for you and what you have agreed with them on security. |
| Your backups§ 30(2) no. 3 | What is backed up, with what, and when restoring was last tested. |
| Your training§ 30(2) no. 7 · § 38(3) | Who attended which training and when, staff and management. |
| Second factor and secured communication§ 30(2) no. 10 | Where a second factor protects sign-in and which channels you use for secured communication. |
| Management review§ 30(2) no. 6 · § 38(1) | When management checked whether the measures work, what it decided and who does what by when. |
More for certain digital providers
Providers such as cloud, data centres, managed services and some other digital services are also subject to Implementing Regulation (EU) 2024/2690. Its Annex describes many records in more detail.
For all other companies that Annex is not binding. It can serve as guidance.
§ 30(3) BSIG · Implementing Regulation (EU) 2024/2690
Who the Implementing Regulation applies toWhat this means for a company with 50 to 150 employees
You do not need a collection of templates for every detail. One document per area where a text is needed, and lists you keep up to date for the rest.
More important than length is that the documents fit your business and that what they say actually happens.
The law does not require a certificate such as ISO 27001. It can support your evidence, though.
§ 30(1), second and third sentences, BSIG
An example
A made-up company: a packaging machinery manufacturer with 110 employees. Machinery manufacturing is listed in Annex 2 of the BSIG, so the company is an important entity.
The IT manager writes down what the company works with: ERP, design software, production control, email, backup. Next to each is who supplies it.
His answers on the ten areas produce the six documents. The incident response plan says that the managing director decides and the IT lead reports.
The company keeps suppliers, backups and training as lists.
The managing director reads the documents and approves them. When a new service provider joins, IT adds it to the supplier list.
How the walkthrough does this
In the walkthrough at nisd2.eu, the documents come out of your answers.
Your answers produce six documents: security policy, incident response plan, business continuity plan, cryptography policy, staff, access and asset policy, and rules for buying, maintenance and vulnerabilities.
You can add your own provisions to each document.
Where a list is enough, you keep a list: your IT, your suppliers, your backups, your training.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
The export puts everything in one document, which you save as a PDF in the browser.
Common questions
Which documents does NIS2 require?
The BSIG requires you to document the implementation of your measures (§ 30(1), third sentence). It explicitly names policies for risk analysis and IT security, effectiveness, cryptography, and staff, access and IT management (§ 30(2) nos. 1, 6, 8 and 9).
Is there a prescribed format?
No. The law sets neither format nor length. The documents follow your company's risk, size and costs.
Do the documents have to be signed?
The BSIG does not prescribe a signature. But management has to implement and oversee the measures (§ 38(1) BSIG), and the EU directive requires it to approve them (Art. 20(1) NIS 2). A recorded approval by management is therefore the obvious choice.
Do we need ISO 27001 certification?
The law does not require it. A certificate can support your evidence but does not automatically cover the BSIG.
Sources
- BSI Act (BSIG) §§ 30 and 38, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 20 and 21, EUR-Lex
- Implementing Regulation (EU) 2024/2690, Art. 1 and Annex, EUR-Lex
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write the security policy
A short policy that management approves.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
