--- title: "NIS 2 Mandatory Documents: Board Approval" description: "NIS 2 mandatory documents master guide: what must be approved by the board, required signatures, and document hierarchy for baseline compliance." canonical: https://www.aegister.com/en/cms/insights/nis2-mandatory-documents-master-guide-board-approval/ url: /en/cms/insights/nis2-mandatory-documents-master-guide-board-approval/ lang: en --- ![](https://www.aegister.com/static/images/header-contact.webp) # NIS 2 mandatory documents master guide: what must be approved by the board and what to prepare now Appendix C lists 11 documents requiring board-level approval under NIS 2 baseline obligations. With incident notification already live and baseline measures due October 2026, this guide maps the full mandatory package and provides a 30-day board-ready activation checklist. January 26, 2026 3 min read ![Board members around a table while one of them signs a document](https://www.aegister.com/static/images/cms/theme-board-approval.webp) Made with AI [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/)[NIS 2 baseline measures](https://www.aegister.com/en/cms/keyword/nis-2-baseline-measures/)[ACN](https://www.aegister.com/en/cms/keyword/acn/)[Governance](https://www.aegister.com/en/cms/keyword/governance/) Contents 1. [Key takeaways](#key-takeaways) 2. [Live timeline status (first application)](#live-timeline-status-first-application) 3. [Appendix C matrix: mandatory documents requiring board-level approval](#appendix-c-matrix-mandatory-documents-requiring-board-level-) 4. [How to structure the mandatory package without exposing sensitive implementation details](#how-to-structure-the-mandatory-package-without-exposing-sens) 5. [Minimum content blocks to standardize across all 11 documents](#minimum-content-blocks-to-standardize-across-all-11-document) 6. [30-day board-ready activation checklist](#30-day-board-ready-activation-checklist) 7. [FAQ](#faq) 8. [Conclusion and next steps](#conclusion-and-next-steps) 9. [Related reading](#related-reading) 10. [Official sources](#official-sources) Incident-notification obligations are already live in first application. Baseline security-measure adoption remains due by **October 2026**. For most organizations, the immediate task is to close the [mandatory Appendix C document package](https://www.aegister.com/en/solutions/compliance/nis2/documentation-audit/) and complete board-level approvals in time. ## Key takeaways - Appendix C identifies **11 documents** that require approval by governing and management bodies. - The incident-notification obligation is already live; documentary governance cannot remain in draft-only status. - The baseline-measure implementation milestone remains **October 2026**, so approval and evidence cycles should be completed before that date. - A template-driven approach accelerates consistency, but accountability remains with the organization. ## Live timeline status (first application) | Milestone | Official timing | Status on 2026-02-22 | Operational meaning | | --- | --- | --- | --- | | Significant-incident notification obligations | 9 months (January 2026) | Live | Notification process must be operational now | | Baseline security-measure adoption | 18 months (October 2026) | Upcoming | Document package and controls must be completed by deadline | ## Appendix C matrix: mandatory documents requiring board-level approval | Mandatory document | Requirement reference | Board approval required | | --- | --- | --- | | Cybersecurity organization | GV.RR-02 point 1 | Yes | | Cybersecurity policies | GV.PO-01 point 1 | Yes | | Risk assessment of information and network systems | ID.RA-05 point 3 | Yes | | Risk treatment plan | ID.RA-06 point 3 | Yes | | Vulnerability management plan | ID.RA-08 point 4 | Yes | | Improvement plan | ID.IM-01 point 1 | Yes | | Business continuity plan | ID.IM-04 point 1 | Yes | | Disaster recovery plan | ID.IM-04 point 1 | Yes | | Crisis management plan | ID.IM-04 point 1 | Yes | | Training plan | PR.AT-01 point 1 | Yes | | Incident management plan | RS.MA-01 point 2 | Yes | ## How to structure the mandatory package without exposing sensitive implementation details ### 1. Keep approval governance explicit Each document should include owner, approver, approval date, review cadence, and version history. ### 2. Keep scope and boundaries explicit State which systems, services, and organizational units are covered and which are out of scope with rationale. ### 3. Keep evidence hooks embedded For each policy/plan, define required records and where evidence is stored (registers, logs, reports, minutes). ### 4. Keep operational dependencies mapped Link each document to procedures, inventories, and responsible teams so approval is not detached from execution reality. ## Minimum content blocks to standardize across all 11 documents 1. Purpose and legal/reference basis. 2. Scope and applicability conditions. 3. Roles and responsibilities (including substitutes where relevant). 4. Required controls or operational steps. 5. Evidence and record-keeping requirements. 6. Exceptions and risk-based rationale fields. 7. Review/approval/update cycle. ## 30-day board-ready activation checklist 1. Build one consolidated register of the 11 mandatory documents and assign owners. 2. Align template versions and remove contradictory definitions across documents. 3. Add approval blocks and review cadence to all mandatory documents. 4. Run legal/compliance quality review before board submission. 5. Schedule board/management approval sessions and track decisions in minutes. 6. Link approved documents to execution procedures and evidence registers. ## FAQ ### Are all Appendix C documents required to be approved by governing bodies? Yes. Appendix C explicitly lists the documents and references the specific requirements requiring approval. ### Is the incident-notification obligation still a future milestone? No. In ACN first application, the 9-month milestone is January 2026, and the obligation is already live. ### How can organizations accelerate this phase without lowering quality? A standardized template library with controlled data collection, versioning, and approval workflow usually reduces rework and governance friction while preserving accountability. ## Conclusion and next steps The most effective sequence is: lock the Appendix C mandatory package, complete board approvals, and connect each approved document to operational evidence flows before October 2026. Aegister’s template-driven compliance workflows are designed to support this transition with structured collection, controlled drafting, and governance-ready outputs. ## Related reading - [NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations](https://www.aegister.com/en/cms/insights/nis2-baseline-obligations-master-overview/) - [NIS2 operational templates for GRC teams: what to prepare and why it matters](https://www.aegister.com/en/cms/insights/nis2-operational-templates-grc-teams/) - [NIS2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof](https://www.aegister.com/en/cms/insights/nis2-documentary-evidence-audit-readiness/) - [Aegister NIS2 Compliance Service](https://www.aegister.com/en/solutions/compliance/nis2/) - [Aegister Virtual CISO Service](https://www.aegister.com/en/solutions/virtual-ciso/) ## Official sources - [ACN - Guida alla lettura delle specifiche di base](https://www.acn.gov.it/portale/documents/d/guest/guida-alla-lettura-specifiche-di-base) - [ACN - Determinazione obblighi di base 379907/2025](https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed) - [ACN - Modalità e specifiche di base](https://www.acn.gov.it/portale/nis/modalita-specifiche-base) - [Gazzetta Ufficiale - Decreto Legislativo 138/2024](https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG) This article was reviewed with AI tools for proofreading and error checking. Despite these checks it may contain inaccuracies: for compliance decisions, always refer to the official texts. Self-assessment · NIST CSF 2.0 · ISO 27001 ### Cyber Check-up A self-assessment that returns your company's cyber profile: its security posture and the recommendations to mitigate risks and start your cybersecurity journey. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/) Our service ### NIS 2 We guide you to compliance with the NIS 2 Directive: requirements analysis, security measures, incident notification and documentation audit. [Learn more](https://www.aegister.com/en/solutions/compliance/nis2/) Share this post: Self-assessment ### Cyber Check-up Answer the questionnaire and get your company's cyber profile: security posture and recommendations to mitigate risks. [Start the Cyber Check-up](https://www.aegister.com/en/assessment/) ### NIS 2 We guide you to compliance with the NIS 2 Directive: requirements analysis, security measures, incident notification and documentation audit. [Learn more](https://www.aegister.com/en/solutions/compliance/nis2/) ## Related news January 30, 2026 ### [NIS 2 remediation roadmap (Piano di Adeguamento): practical guide for ID.IM-01 approval](https://www.aegister.com/en/cms/insights/nis2-remediation-roadmap-id-im-01/) The remediation roadmap is mandatory under NIS 2 Appendix C (ID.IM-01). This guide covers how to consolidate gaps, prioritize actions, align mileston… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [NIS 2 baseline measures](https://www.aegister.com/en/cms/keyword/nis-2-baseline-measures/) [ACN](https://www.aegister.com/en/cms/keyword/acn/) +9 February 06, 2026 ### [NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document](https://www.aegister.com/en/cms/insights/nis2-crisis-management-plan-id-im-04/) The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [NIS 2 baseline measures](https://www.aegister.com/en/cms/keyword/nis-2-baseline-measures/) [ACN](https://www.aegister.com/en/cms/keyword/acn/) +10 February 06, 2026 ### [NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document](https://www.aegister.com/en/cms/insights/nis2-disaster-recovery-plan-id-im-04/) The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem… [NIS 2](https://www.aegister.com/en/cms/keyword/nis-2/) [NIS 2 baseline measures](https://www.aegister.com/en/cms/keyword/nis-2-baseline-measures/) [ACN](https://www.aegister.com/en/cms/keyword/acn/) +10