Governance
Roles, responsibilities and board approvals: what NIS 2 asks of the people who run the company, and how to prove it.
All articles
NIS 2 business continuity plan: practical guide to build an approvable ID.IM-04 document
The business continuity plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must include, a practical temp…
NIS 2 vulnerability management plan: practical guide for ID.RA-08 approval
The vulnerability management plan is mandatory under NIS 2 Appendix C (ID.RA-08). This guide covers what an approvable plan must show, a practical st…
NIS 2 cybersecurity training plan: practical guide for an approvable PR.AT-01 document
The cybersecurity training plan is mandatory under NIS 2 Appendix C (PR.AT-01). This guide covers what an approvable plan must contain, a practical t…
Cybersecurity Monthly Report - January 2026 (Italy, EU, Global)
Aegister’s January 2026 monthly cybersecurity report: EU cybersecurity package with Cybersecurity Act revision and NIS 2 simplification amendments, D…
NIS 2 remediation roadmap (Piano di Adeguamento): practical guide for ID.IM-01 approval
The remediation roadmap is mandatory under NIS 2 Appendix C (ID.IM-01). This guide covers how to consolidate gaps, prioritize actions, align mileston…
NIS 2 Governance Controls (GV): Policies, Roles, and Accountability Model
The NIS 2 Governance (GV) domain defines cybersecurity direction, accountability, and oversight. Practical guide to implementing GV controls: context…
NIS 2 risk treatment plan: practical guide for ID.RA-06 approval
The risk treatment plan is mandatory under NIS 2 Appendix C (ID.RA-06). This guide covers what an approvable plan must show, a practical structure wi…
NIS 2 risk assessment document for systems and networks: practical guide for ID.RA-05 approval
The risk assessment of information and network systems is mandatory under NIS 2 Appendix C (ID.RA-05). This guide covers what an approvable assessmen…
NIS 2 cybersecurity organization document: how to structure it for GV.RR-02 approval
The cybersecurity organization document is mandatory under NIS 2 Appendix C (GV.RR-02). This guide covers what it must prove, a practical template st…
NIS 2 Article 23 in Practice: Obligations for Management and Governing Bodies
Article 23 of Italy's NIS decree requires governing bodies to formalize cybersecurity governance, approve policies, oversee implementation, and maint…
NIS 2 cybersecurity policies document: practical guide for GV.PO-01 approval
Cybersecurity policies are mandatory under NIS 2 Appendix C (GV.PO-01). This guide covers what an approvable policy package must include, a modular t…
NIS 2 operational templates for GRC teams: what to prepare and why it matters
NIS baseline guidance identifies a concrete documentation set required for governance approval. This guide maps the Appendix C template set, explains…
NIS 2 mandatory documents master guide: what must be approved by the board and what to prepare now
Appendix C lists 11 documents requiring board-level approval under NIS 2 baseline obligations. With incident notification already live and baseline m…
NIS 2 baseline obligations in practice: master overview for governance, controls, and incident operations
A structured operational overview of Italy’s NIS 2 baseline obligations: governance (Art. 23), risk management (Art. 24), and incident notification (…
NIS 2 Legal Architecture and Role Model in Italy: Who Is Accountable for What
Italy's NIS 2 legal architecture explained: Legislative Decree 138/2024, ACN baseline acts, and the three-layer accountability model for governance, …
The EU Cyber Solidarity Act: A New Pillar of Collective Resilience
The EU Cyber Solidarity Act introduces coordinated mechanisms and shared capabilities to improve threat detection, incident response, and strategic r…
Cybersecurity Update - Week 22 of 2025
Aegister's weekly cybersecurity update for Week 22 of 2025, covering major threats, trends, regulatory changes (NIS 2, DORA), GRC topics, and interna…
Cybersecurity Monthly Report - January 2025 (Italy, EU, Global)
Aegister's January 2025 monthly cybersecurity report: DORA goes live, NIS 2 registration milestones, key vulnerabilities (VPN/edge), ransomware polic…