Written by a practitioner in NIS2 scope.
The directive tells you what. This toolkit is the how the registers, policies, incident-reporting playbook and 90-day roadmap a real in-scope organisation uses, written by someone running production Active Directory and a self-hosted SIEM inside an EU org in NIS2 scope.
See what's in the toolkit First: am I even in scope? →
Answer the scope question first, then take the one-page reference. Both are genuinely useful on their own, and there is no better way to judge whether the paid toolkit is worth it.
Answers Are we in scope? Essential or Important?
A six-question checker that gives a defensible working answer in a couple of minutes, the size test, the sector test, and the size-independent rules that catch people who assume they are too small.
Best for pinning above your desk
The whole directive distilled: who's in scope, the ten Article 21 measures with the one thing to get right on each, and the reporting clock. The reference you'll actually keep.
This is the first question, and the most-mis-answered one. Answer honestly for the whole legal entity. You'll get a working classification and what it means. Not legal advice, confirm against your national transposition.
JavaScript is off, so here's the rule directly: you're generally in scope if you meet the size gate (Q1 or Q2 = yes) and a sector (Q4 or Q5 = yes), Essential if large in Annex I, Important otherwise. Q6 puts you in regardless of size. Confirm nationally.
Prefer paper? The printable worksheet is included in the free cheat sheet and the toolkit's implementation guide.
A guided workbook and a control-by-control checklist. Enough to get a small team to a defensible baseline, and everything maps straight onto the Core toolkit when you outgrow it.
Best for a small team starting cold
One guided document you work top to bottom, filling in the prompts: scope decision, governance setup, starter risk list, incident-reporting details and a gap list that becomes your project plan.
Best for a fast self-assessment
Governance, all ten Article 21 measures and the reporting duty as 40 concrete items, each with what "done" looks like, plus Status / Owner / Evidence columns so it doubles as an assurance tracker.
The Workbook and the Checklists together, the fastest way to find out where you stand and what to fix first.
Launching shortly
Nine deliverables that fit together, the guide explains it, the registers record it, the playbook handles the incident, the policies document it, the roadmap sequences it, and the board pack proves management owned it.
All nine deliverables in one download. Built for the in-scope SMB and the consultant, MSP or internal team serving one, proportionate, practical, and mapped to the framework you already run.
Launching shortly
Every tier is a step up from the last, and each one credits into the next. Start where you are.
| Tier | What you get | Best for | Price | |
|---|---|---|---|---|
| Free | Scope self-check + one-page cheat sheet | "Are we in scope?" | $0 | Start |
| Entry | Starter Pack: Implementation Workbook + 40-item Checklists | A small team starting cold | Coming soon | Preview |
| Core | Compliance Toolkit: guide, control mapping, 3 registers, incident playbook, 10 policies, roadmap, board pack | Getting to audit-ready | Coming soon | Preview |
| Premium | Team / MSP Edition · Workshop Pack | Delivering NIS2 to others | Coming soon | See both |
NIS2 asks you to prove the controls. These are the read-only tooling and reference packs that produce that evidence, the Article 21 measures made concrete.
Windows Server & AD hardening checklists, the 21(e)/21(g) baseline in a working form.
Phase-by-phase triage for compromised accounts, ransomware and lateral movement, the response half of 21(b).
Read-only AD audit scripts (DCSync rights, delegation, dangerous ACLs), evidence for 21(i)/21(j).
No. NIS2 is Directive (EU) 2022/2555, transposed into national law by each Member State. This is implementation guidance written by a practitioner, it builds the security programme. Confirm the legal specifics against your national transposition and, where the stakes justify it, your counsel.
In-scope SMBs and the consultants, MSPs and internal IT/security teams serving them. It is written to be proportionate a 60-person organisation is not held to a national bank's standard, and the guidance says so throughout.
Editable working files: the guide, playbook, roadmap and board pack as PDFs; the risk, asset and evidence registers plus the Article 21 control mapping as spreadsheets; the ten policies as ready-to-adopt templates. Nothing is DRM-locked and nothing phones home.
Yes. Every Article 21 measure is cross-walked to ISO/IEC 27001:2022 Annex A, NIST Cybersecurity Framework 2.0 and CIS Controls v8, so it slots into a framework you already run rather than starting over.
It is built by someone running production Active Directory, Windows Server and a self-hosted SIEM inside an EU organisation in NIS2 scope. The registers ship pre-seeded with worked examples, the incident playbook has the reporting clock wired in, and every measure comes with the common mistake and the evidence an auditor actually asks for. The blog shows the depth for free, read it first.