NIS2 compliance,
as a system.
Active enforcement across the EU for essential and important entities in 18 sectors. One complete, downloadable document system covering every NIS2 Art. 21 obligation — from gap assessment to board reporting, including a Country Pack for your national transposition.
NIS2 Complete System
$699 + VAT
"The complete NIS2 compliance programme — all 17 documents, Country Pack included."
17 documents · incl. Country Pack · Excel + Word
View system →
Save $199DORA + NIS2 Complete Bundle
$1,299 + VAT
"For organisations carrying both regimes — both complete systems in one purchase."
36 documents · incl. Country Pack · Excel + Word
View bundle →
Every document is delivered as an editable Word or Excel file, mapped to the NIS2 Art. 21 security domains it covers. The Country Pack is delivered alongside, in the same .zip.
| NIS2 Compliance Gap Assessment | ✓ |
| NIS2 Security Risk Assessment Framework | ✓ |
| NIS2 Incident Classification & Severity Framework | ✓ |
| NIS2 Incident Response Playbook | ✓ |
| NIS2 Security Risk Management Policy | ✓ |
| NIS2 Incident Management & Reporting Procedure | ✓ |
| NIS2 Supply Chain & Vendor Due Diligence Pack | ✓ |
| NIS2 Security Awareness & Training Tracker | ✓ |
| NIS2 Internal Audit & Evidence Pack | ✓ |
| NIS2 Supply Chain Security Policy | ✓ |
| NIS2 Access Control & HR Security Policy | ✓ |
| NIS2 Cryptography & Encryption Policy | ✓ |
| NIS2 Compliance Monitoring Dashboard | ✓ |
| NIS2 Incident Register & Tracker | ✓ |
| NIS2 Compliance Roadmap | ✓ |
| NIS2 Board Reporting Pack | ✓ |
| Country Pack (all 27 EU Member States) | ✓ |
What is the Country Pack and how is it delivered?
NIS2 is a directive — each EU Member State transposed it into national law with its own authority, thresholds and notification details. The Country Pack is a single file covering all 27 EU Member States, included at no extra cost with NIS2 Complete and the DORA + NIS2 bundle, and delivered in the same .zip as the rest of your documents.
Does NIS2 apply to my organisation?
NIS2 applies to medium and large entities in 18 sectors — energy, transport, banking, health, digital infrastructure, public administration and more. If uncertain, consult your national competent authority or a qualified legal adviser.
What exactly do I receive after payment?
A single .zip with all documents in editable Word and Excel formats, including the Country Pack, delivered by email within seconds. Tax invoice generated automatically by Gumroad.
How is VAT handled?
Displayed prices exclude VAT. Applicable VAT is calculated at checkout based on your location, and Gumroad (our merchant of record) collects and remits it. EU businesses with a valid VAT ID pay no VAT under the reverse-charge mechanism — simply enter your VAT ID at checkout.
Why are prices shown in USD?
Payments are processed by Gumroad, our global payment provider, which settles all transactions in US dollars. We show prices in USD so the amount you see is exactly the amount you are charged — no surprises at checkout. Your bank converts to your local currency automatically.
Is there a smaller or cheaper version?
No. NIS2 is sold as one complete system, so you never pay twice for documents you already own. If you also fall under DORA, the DORA + NIS2 bundle saves $199 against buying both separately.
More questions? Read the full FAQ →
One system, one price
Every Art. 21 domain, one purchase.
17 editable documents, including the Country Pack for all 27 EU Member States. Updates included for 12 months.
Pair with the EU Compliance Workspace
Your NIS2 documents, operated in Notion.
The documents define what you must do. The workspace is where your team records that it is being done, and where an auditor can see it. You enter what the documents specify — there is no automated import.
| In the document system | In the workspace | What it becomes |
|---|---|---|
| Compliance Gap Assessment | Compliance Requirements | Each Art. 21 gap becomes a requirement record, visible until a control closes it. |
| Security Risk Assessment Framework | Risk Register | Cybersecurity risks scored and linked to the measures that treat them. |
| Incident Classification · Authority Reporting Procedure | Incident Register | Every significant incident logged against the 24-hour and 72-hour notification timelines. |
| Supply Chain & Vendor Due Diligence Pack | Vendor Risk Register | Direct suppliers assessed and tracked under Art. 21(2)(d). |