NIS2 Compliance Kit
72 ready-to-use documents for the complete NIS2 implementation. Aligned with § 30 BSIG (10 mandatory measure categories) and § 38 BSIG (management training + personal liability). DACH-specific.
Concrete risks & enforcement practice
Personal management liability
§ 38 BSIG: Management board members are personally liable with private assets for unimplemented cybersecurity measures. Waiver or settlement only possible after 3 years (§ 38(5)).
24h/72h reporting duty
24-hour early warning, 72-hour incident report — no exceptions.
Fines up to EUR 10 million
Essential entities: up to EUR 10 million or 2% of annual revenue.
All 10 § 30 BSIG mandatory measure categories — covered
Scope & BSI Registration
Scope assessment, sector classification (18 sectors), group structure analysis, DORA/NIS2 demarcation, BSI registration form template.
Governance & § 38 BSIG Liability
Management body resolution, liability briefing (§ 38 para. 2 BSIG: internal liability via § 43 GmbHG / § 93 AktG; waiver/settlement subject to 3-year statutory period under corporate law), training plan, RACI matrix, CISO quarterly report.
Risk Management & ISMS
Information security policy, risk methodology, risk register, risk treatment plan. Compatible with ISO 27001 and BSI Grundschutz.
Incident Response (§ 32 BSIG)
Incident response policy + playbook, 24h early warning, 72h notification, intermediate & final reports, significant incident classification (per EU IR 2024/2690).
Business Continuity & Crisis
BCP, backup & recovery, disaster recovery, crisis management & communication.
Supply Chain Security
Vendor questionnaire, scoring, contract clauses (cybersecurity).
Secure Development & Vulnerability
Secure development policy, vulnerability management, vulnerability disclosure (CVD).
Cyber Hygiene & Training
Cyber hygiene policy, employee training programme, phishing awareness, password & MFA hygiene.
Cryptography & Access
Cryptography policy, IAM, MFA policy, asset inventory, secure communication, emergency communication.
Audit & Evidence
Audit checklist, SoA, evidence inventory, compliance dashboard, audit simulation, pentest RFP, ISO 27001 mapping, BSI Grundschutz mapping.
3 steps to your kit
Fill out the order form
Company details, VAT ID (optional, for reverse-charge), select your tier. You receive an immediate order confirmation by email.
Invoice & bank transfer
Within 24 hours (business days) you receive a proper invoice. Payment term 14 days by bank transfer. For EU B2B with valid VAT ID: reverse-charge.
Download by email
Once payment is received, you get a signed download link to all personalised professional templates. Link valid for 7 days, extendable once.
Choose your tier
Purchase as a business under § 1 KSchG / § 14 BGB. By clicking "Order" you accept our Terms and Privacy Policy.
- 72 editable templates
- Personalised with your company name
- Buy once, always up-to-date
- 60-day money-back guarantee*
- License for buyer + corporate group (§ 15 AktG)
- 72 editable templates
- Personalised with your company name
- Buy once, always up-to-date
- 60-day money-back guarantee*
- License for buyer + corporate group (§ 15 AktG)
- E-learning module (employee training)
- 72 editable templates
- Personalised with your company name
- Buy once, always up-to-date
- 60-day money-back guarantee*
- License for buyer + corporate group (§ 15 AktG)
- E-learning module (employee training)
- Trainer pack (PowerPoint + trainer materials for in-house training)
All documents are pre-filled with your company name and license ID. Download link via email.
Multi-company license for corporate groups
Multiple independent sister companies without group affiliation (§ 15 AktG)? +50% surcharge extends the license to 3 companies in total (main customer + 2 sister companies).
Example: Plus 1,290 EUR × 1.50 = 1,935 EUR. Choose the multi-company license at checkout. Details in our Terms § 6.
Note: Templates are based on current case law and source-verified before delivery. Customisation to your specific company situation and final legal review are recommended. 60-day money-back guarantee* per Terms § 8.
Frequently bought together
What we stand for
Money-back guarantee
If you find any errors, we refund the full purchase price. Details in Terms § 8.
Always current
Updates without time limit within the major version: new regulatory guidelines, CJEU rulings, known follow-up phases of a regulation. Terms § 7.
Source-based + documented
Every document is based on EU regulatory text, BfDI/DSK/BSI/EDPB guidelines, and supreme court case law — the as-of date is noted in each document.
Frequently asked questions
Is my company affected by NIS2? Which sectors?
Essential entity: ≥ 250 employees or > EUR 50 million revenue / > EUR 43 million balance sheet — fine up to EUR 10 million / 2% revenue.
Important entity: ≥ 50 employees / > EUR 10 million revenue — fine up to EUR 7 million / 1.4%.
The 18 sectors:
- Essential (Annex I): Energy · Transport · Banking · Financial market infrastructure · Health · Drinking water · Wastewater · Digital infrastructure (DNS, TLD, cloud, data centres, internet exchange points, CDN, trust services) · ICT service management (B2B) · Public administration · Space
- Important (Annex II): Postal/courier · Waste management · Chemicals · Food production/trade · Manufacturing (medical devices, computer/electronics, machinery, vehicles, other transport) · Digital providers (marketplaces, search engines, social networks) · Research
Also covered: companies that are the sole provider of an essential service or critical for other entities — regardless of size. Quick check with our NIS2 readiness check.
Which tier fits me — Basis, Plus or Komplett?
Basis (EUR 990 net) — You have internal compliance staff (DPO/CISO/HR lead) who can adapt and implement all documents themselves. No employee e-learning required.
Plus (EUR 1,290 net) — most popular — You want to train employees interactively (e.g. to fulfil the AI literacy obligation under Art. 4 EU AI Act or the Section 12 AGG protective measures for the liability privilege). Includes a ready-made e-learning module with quiz and attendance certificate.
Komplett (EUR 1,490 net) — You want to run the trainings internally and repeatedly (e.g. for new hires) without booking an external trainer every time. Additionally includes the Trainer Pack: PowerPoint slides with notes, trainer handbook and quiz pool.
What is included in the kit?
72 editable templates covering the full NIS2 / BSIG cybersecurity scope: ISMS handbook (§ 30 BSIG), risk management framework, incident-response playbook (24h / 72h / 1-month staged report under § 32 BSIG), supply-chain risk register, business continuity plan, encryption / MFA policies, access control matrix, awareness training programme, executive liability evidence pack (§ 38 BSIG).
Can I keep the templates forever?
Yes. After purchase you receive a download link containing all personalised professional templates. The files belong to you completely — you can store, integrate, edit and archive them. No cloud dependency, no per-device license activation, no internet connection required for use.
What does "buy once, always up-to-date" mean?
You receive all updates of the kit as long as the kit is maintained in its current major version. Updates arrive when authorities (BSI, ENISA) publish new guidance, new case law is published, or known follow-up phases of a regulation kick in. If a substantially new regulation supersedes the existing one, a new major version emerges — existing customers receive a 50% discount. Details in Terms § 7.
What does the 60-day money-back guarantee cover?
If a template content is provably legally incorrect (proven by a lawyer's letter or authority statement), we refund the purchase price. Deadline: 60 days from delivery. Details in Terms § 8.
Am I covered by NIS2?
NIS2 covers "essential" (KRITIS, energy, water, transport, finance, health, digital infra) and "important" (B2B IT, postal, waste, chemicals, food, manufacturing, research) sectors. Size thresholds: 50+ employees OR EUR 10M+ turnover for "important", or 250+ / EUR 50M+ for "essential". § 30 BSIG (DE): in force since 06.12.2025. Even sub-threshold companies are often covered as suppliers (Art. 21(2)(d)).
What are the executive liability risks?
§ 38 BSIG: management bodies are personally liable for cybersecurity risk management. They must approve risk-management measures, oversee implementation, and undergo training. Fines: up to EUR 10 million or 2% of worldwide turnover for essential entities, EUR 7 million or 1.4% for important entities.
What about incident reporting deadlines?
Three-stage report under § 32 BSIG / Art. 23 NIS2: 24-hour early warning, 72-hour incident notification with initial assessment, one-month final report with root cause analysis. The kit includes a ready-to-use incident-response playbook and BSI report templates.
Does ISO 27001 cover NIS2?
ISO 27001 covers approximately 80% of Art. 21 NIS2 / § 30 BSIG technical-organisational measures. NIS2-specific requirements beyond ISO 27001: incident reporting workflows, supply-chain risk management (Art. 21(2)(d)), executive training duty (§ 38), the BSI register (§ 33 BSIG). Mapping workbook included.
Are subsidiaries automatically in scope?
Not automatically, but under group consolidation: the employee and turnover thresholds apply group-wide (§ 28(4) BSIG). Result: many subsidiary GmbHs qualify as "important entities" even if they would fall below 50 employees on a stand-alone basis. A separate BSI registration is required for each affected unit.
Is MFA mandatory everywhere?
Yes, effectively. § 30(2) No. 10 BSIG requires "multi-factor authentication or continuous authentication solutions". BSI recommendation: all administrator accounts plus all external access paths (VPN, cloud) protected by MFA. For pure office workstation use (no remote access, no elevated privileges), a risk-based justification is defensible.
How often must management bodies be trained?
BSIG does not specify a frequency. BSI recommendation (Management Body Guidance 2024): upon appointment plus annual refresher. Industry standard: semi-annual training for management of essential entities, annual for important entities. Online training with knowledge test and certificate satisfies the requirement under § 38(3) BSIG.
24-hour early warning — in what form?
An acknowledgement filed with BSI via the "Mein Unternehmenskonto" portal within 24 hours of becoming aware of a significant incident. Contents: initial assessment only, not the full report. The definition of "significant incident" is technically specified in Commission Implementing Regulation (EU) 2024/2690 (number of affected users, damage thresholds, etc.).
IT outsourced — still subject to NIS2 obligations?
Yes. The client remains fully responsible. Mandatory: supply-chain security under § 30(2) No. 5 BSIG — contractual cybersecurity clauses, mandatory incident notification by the service provider to the client, right-to-audit. Cloud providers are separately subject to NIS2 (with their own BSI registration).
Which contract clauses do we need with IT service providers?
At minimum: incident notification (pass-through of the 24-hour duty), right to audit/pentest, minimum security standards, right-to-audit, emergency contact interface. BSI has published model clauses in the NIS2 guidance document "Cybersecurity in the Supply Chain".
NIS2 vs. ISO 27001 vs. TISAX?
Three different regimes: NIS2 is a statutory obligation (BSIG); ISO 27001 is a voluntary certification (international standard); TISAX is an automotive-sector special standard. Overlap: ISO 27001 and TISAX cover many NIS2 requirements. Mapping: the NIS2 Kit includes a crosswalk table.
NIS2 vs. DORA — what applies to banks?
DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) is lex specialis for financial entities. Entities falling under DORA are excluded from NIS2 (Art. 4 NIS2 Directive). Practice: banks, insurers, payment service providers → DORA. Non-financial subsidiaries of a banking group → possibly NIS2.
Fines also without an actual incident?
Yes, possible. Sanctioned offences are breaches of duty — missing risk management measures under § 30 BSIG, missing management body approval under § 38, missing registration. Even without concrete damage. BSI supervises on a non-event-triggered basis.
Fines against managing directors personally?
Administrative fines are imposed on the entity. HOWEVER: § 38(2) BSIG refers to corporate-law rules (§ 43 GmbHG / § 93 AktG) for the management body's internal personal liability towards the entity. If the company pays a fine and the breach of duty is attributable to the managing director, the company may seek recourse against the director's private assets under corporate law. D&O insurance does not necessarily respond in cases of gross negligence.
Is an external audit mandatory?
§ 30 BSIG requires "concepts for assessing effectiveness". An external audit certification is not strictly mandatory but practically useful. ISO 27001 certification covers a large part of the requirements. A pentest requirement is not explicitly written into the law, but is a BSI recommendation.
Logs — how long must they be retained?
BSIG does not specify a concrete retention period. Industry standard: minimum 12 months, 36 months in case of incidents. Note the GDPR conflict: logs containing personal data are subject to Art. 5(1)(e) GDPR (storage limitation). Anonymisation/pseudonymisation is recommended for long-term retention.