NIS2 compliance,
as a system.
Active enforcement across the EU for essential and important entities in 18 sectors. Three downloadable document systems covering every NIS2 Art. 21 obligation — from gap assessment to full compliance programme, including a Country Pack for your national transposition.
"We're starting from zero and need to know where we stand."
→ Assessment & Response · gap assessment, risk framework, incident basics + Country Pack · $99 + VAT
"We need board-approvable policies and supply chain due diligence."
→ Risk & Governance · everything in A&R plus policies + Country Pack · $179 + VAT
"We want every Art. 21 domain covered, ready for the authority."
→ Complete System · all 17 documents + Country Pack · $699 + VAT
Assessment & Response System
$99 + VAT
"Everything you need to understand where you stand and manage your first security incident."
4 documents + Country Pack · Excel + Word
View system →
Most popularRisk & Governance System
$179 + VAT
"The complete governance, risk, incident and supply chain framework + Country Pack."
7 documents + Country Pack
View system →
Best valueComplete System
$699 + VAT
"The complete NIS2 compliance programme — all 17 documents + Country Pack."
17 documents + Country Pack · everything in R&G + 10 more
View system →
Every document is delivered as an editable Word or Excel file, mapped to the NIS2 Art. 21 security domains it covers.
| Document | A&R $99 + VAT |
Risk & Gov. $179 + VAT |
Complete $699 + VAT |
|---|---|---|---|
| NIS2 Compliance Gap Assessment | ✓ | ✓ | ✓ |
| NIS2 Security Risk Assessment Framework | ✓ | ✓ | ✓ |
| NIS2 Incident Classification & Severity Framework | ✓ | ✓ | ✓ |
| NIS2 Incident Response Playbook | ✓ | ✓ | ✓ |
| NIS2 Security Risk Management Policy | — | ✓ | ✓ |
| NIS2 Incident Management & Reporting Procedure | — | ✓ | ✓ |
| NIS2 Supply Chain & Vendor Due Diligence Pack | — | ✓ | ✓ |
| NIS2 Security Awareness & Training Tracker | — | — | ✓ |
| NIS2 Internal Audit & Evidence Pack | — | — | ✓ |
| NIS2 Supply Chain Security Policy | — | — | ✓ |
| NIS2 Access Control & HR Security Policy | — | — | ✓ |
| NIS2 Cryptography & Encryption Policy | — | — | ✓ |
| NIS2 Compliance Monitoring Dashboard | — | — | ✓ |
| NIS2 Incident Register & Tracker | — | — | ✓ |
| NIS2 Compliance Roadmap | — | — | ✓ |
| NIS2 Board Reporting Pack | — | — | ✓ |
| Country Pack (all 27 EU Member States) | ✓ | ✓ | ✓ |
What is the Country Pack and how is it delivered?
NIS2 is a directive — each EU Member State transposed it into national law with its own authority, thresholds and notification details. The Country Pack is a single file covering all 27 EU Member States, included at no extra cost with every NIS2 system and delivered in the same .zip as the rest of your documents.
Does NIS2 apply to my organisation?
NIS2 applies to medium and large entities in 18 sectors — energy, transport, banking, health, digital infrastructure, public administration and more. If uncertain, consult your national competent authority or a qualified legal adviser.
What exactly do I receive after payment?
A single .zip with all documents in editable Word and Excel formats, including the Country Pack, delivered by email within seconds. VAT invoice generated automatically by Gumroad.
How is VAT handled?
Displayed prices exclude VAT. Applicable VAT is calculated at checkout based on your location, and Gumroad (our merchant of record) collects and remits it. EU businesses with a valid VAT ID pay no VAT under the reverse-charge mechanism — simply enter your VAT ID at checkout.
Why are prices shown in USD?
Payments are processed by Gumroad, our global payment provider, which settles all transactions in US dollars. We show prices in USD so the amount you see is exactly the amount you are charged — no surprises at checkout. Your bank converts to your local currency automatically.
Can I upgrade from a smaller system later?
Yes. Each system is a superset of the one below it — start with Assessment & Response, and contact us when you're ready to move up.
More questions? Read the full FAQ →
Not sure which to choose?
Start with Assessment & Response, upgrade anytime.
The Assessment & Response System is the right first step. When you're ready for full coverage, the Complete System includes everything plus a Country Pack.
Pair with GRC Platform
Documents tell you what to comply with.
The workspace proves you are doing it.
The GRC EU Platform is the operational layer — live databases for risks, controls, incidents, vendors and evidence. Works alongside these document systems.