Guides
All articles
NIS 2 Significant Incident IS-1: Confidentiality Loss Affecting Digital Data
IS-1 in the ACN baseline model covers confidentiality loss affecting digital data under entity ownership or control. Practical guide to qualification…
Common NIS 2 compliance mistakes: practical gaps that delay baseline readiness
Most NIS 2 delays are operational: missing evidence, unclear ownership, untested notification workflows, and late governance decisions. A practical g…
NIS 2 Incident Typology Model: Condition, Compromise, and Affected Object
ACN baseline guidance classifies significant incidents through condition, compromise, and object of compromise. Practical guide to using the typology…
NIS 2 operational registers for logs, backups, and recovery: practical guide to auditable evidence
NIS 2 baseline requires operational evidence beyond policies. This guide covers how to build auditable registers for logs, backups, restore tests, an…
NIS 2 incident-notification obligations are live: operating model after the 9-month deadline
The NIS 2 9-month incident-notification deadline passed in January 2026. This guide provides the post-deadline operating model: governance confirmati…
NIS 2 incident management and CSIRT notification plan: practical guide for an approvable RS.MA-01 document
The incident management plan is mandatory under NIS 2 Appendix C (RS.MA-01). This guide covers what an approvable plan must include, a practical temp…
NIS 2 Recovery Controls (RC): Operational Resilience and Service Restoration
The NIS 2 Recovery (RC) domain defines how entities restore operations after incidents and sustain resilience. Practical guide to restoration procedu…
NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document
The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa…
NIS 2 Response Controls (RS): Containment and Eradication in Incident Handling
Containment and eradication are iterative response steps that limit damage and remove attacker persistence. Practical guide to strategy selection, ev…
NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document
The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem…
NIS 2 Response Controls (RS): Signaling and Investigation Operating Model
The NIS 2 Response (RS) domain requires structured incident response through signaling, investigation, and iterative decision loops. Practical guide …
NIS 2 business continuity plan: practical guide to build an approvable ID.IM-04 document
The business continuity plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must include, a practical temp…
NIS 2 vulnerability management plan: practical guide for ID.RA-08 approval
The vulnerability management plan is mandatory under NIS 2 Appendix C (ID.RA-08). This guide covers what an approvable plan must show, a practical st…
NIS 2 Detection Controls (DE): Event Monitoring and Adversarial Signal Handling
The NIS 2 Detection (DE) domain requires monitoring networks, services, and endpoints to identify adverse events early. Practical guide to log readin…
NIS 2 training and cyber-competency register: practical guide to auditable workforce evidence
NIS 2 baseline requires operational evidence of training execution and competency development. This guide covers what a training register must contai…
NIS 2 Protection Controls (PR): Technical and Organizational Measures in Execution
The NIS 2 Protection (PR) domain translates risk decisions into safeguards over identities, data, platforms, and infrastructure. Practical guide to P…
NIS 2 cybersecurity training plan: practical guide for an approvable PR.AT-01 document
The cybersecurity training plan is mandatory under NIS 2 Appendix C (PR.AT-01). This guide covers what an approvable plan must contain, a practical t…
NIS 2 supplier register and supply-chain controls: practical guide for an auditable vendor inventory
NIS 2 baseline includes supply-chain security as a dedicated control area (GV.SC). This guide covers what a NIS 2-ready supplier register must contai…
NIS 2 inventory of relevant systems and assets: practical guide to build an auditable register
NIS 2 baseline compliance requires auditable inventories of systems, assets, and network flows. This guide covers what a NIS 2-ready register must co…
NIS 2 Identification Controls (ID): Inventories, Risk Assessment, and Improvement Cycle
The NIS 2 Identification (ID) domain covers asset visibility, risk assessment, treatment planning, vulnerability processes, and improvement cycles. P…