NIS 2 Starter Kit for important entities – EU edition (Excel, guide, Word templates)

Your company or public body falls under NIS 2 and nobody knows where to start? This kit gives you, in 90 days, a documented scoping, a scored self-assessment, a prioritised action plan and templates signed off by management.

The NIS 2 Starter Kit for important entities – EU edition is a professional pack, in English, with no macros, built by an infrastructure and cybersecurity project manager for organisations of 50 to 250 people in the 18 sectors of the Directive (health, food, manufacturing, waste, water, transport, chemicals, digital, research…), for public bodies, and for suppliers that must answer the requirements of customers in scope. It is based on Directive (EU) 2022/2555 (articles 3, 20, 21, 23, 32 to 34, Annexes I and II): valid in every EU Member State.

What you get

• NIS2-Self-Assessment.xlsx – the self-assessment workbook, 7 sheets, native Excel formulas, compatible with Excel 2016+ and Google Sheets:
  • Read me: 30-minute start, conventions, dated legal status (Directive and what to check nationally).
  • Am I in scope: questionnaire (sector among the 18 annex sectors, headcount, turnover, balance sheet, special cases regardless of size) and calculated result: out of scope, important entity or essential entity; public administration rules of the Directive (central government, regional level, optional local level and education institutions, exclusions); a second fictitious example for comparison.
  • Requirements: the 10 measures of article 21 broken down into 56 control points in 10 domains (governance, risk analysis, incident handling, continuity and crisis management, supply chain, network and system security, cyber hygiene and training, cryptography, HR security and access, MFA and secured communications); for each point: status from a drop-down list, expected evidence, recommended action, owner, due date, score, weighted gap, priority.
  • Action plan: generated by formulas from the gaps, ranked P1/P2/P3, with overdue alerts. Nothing to enter.
  • Incidents: the 24 h / 72 h / 1 month procedure, a deadline calculator, an 18-row register with an automatic check of each deadline (Met, Missed, To send).
  • Dashboard: A4 page for management, compliance rate by domain, RAG status, 2 charts, top 10 actions, incidents.
  • Lists: the 18 sectors and their annexes, size thresholds, scoring parameters and reporting deadlines, editable in one place. Delivered filled with a complete fictitious data set (Cedars Clinic, 180 employees, 2 sites; Northvale Foods, 320 employees): every calculation is visible as soon as you open it; just replace it with your own data.
• NIS2-Guide-Important-Entities.pdf – 24 A4 pages: NIS 2 on one page; the 18 sectors and the thresholds; special cases and public administration; the EU timeline and a dated national-transposition checklist (checked on 17 October 2026); what the Directive settles and what your national law decides; the pending EU amendment of January 2026; the four obligations (registration, management, incident reporting, ten measures); supervision and penalties; the 90-day method day by day; the workbook user guide; templates; checklists; glossary; 16 sources with URL and date.
• NIS2-Templates.docx – 7 Word templates to complete, with the fields in [brackets] highlighted: information security policy (3 pages), incident management and reporting procedure with classification grid and quick-reference card, NIS 2 lead appointment letter, asset register, incident notification template for the national CSIRT or competent authority (early warning, notification, final report), management meeting agenda, board memo.

The method

One appointed lead, three management meetings, 90 days: frame (scope, classification, registration, management training), assess (56 points, simplified risk analysis, incident procedure, high-impact measures), decide (action plan approved, signed policy, crisis exercise, suppliers, dashboard). Then a 15-minute quarterly review.

Exact on the directive, careful on national law

Everything that comes from Directive (EU) 2022/2555 is cited by article: scope, thresholds, article 20 (management), article 21 (measures), article 23 (reporting), articles 32 to 34 (supervision and penalties). Everything that depends on national transposition is flagged in dated boxes: “National transposition: check the law of your Member State and your national CSIRT/competent authority”. Apart from one dated example in the guide, the kit does not state the transposition status of any country; it gives you the checklist of what to verify (law, authorities, registration portal, optional scope, reporting channel, penalties). Replace the national forms with your authority's: the notification template lists the fields of article 23(4).

Quality

No macros, no add-ins. Formulas only in calculated cells, drop-down lists, frozen panes, filters, conditional formatting, named ranges, A4 print areas. Formulas recalculated in Excel (0 error cells) and checked by an independent recalculation, carried out by the publisher, on the fictitious data (182 checks: scores, action plan ranking, scoping result in 22 scenarios, incident deadlines). Written with the help of AI and reviewed by an infrastructure and cybersecurity project manager.

Same files, three levels of rights, chosen at checkout. The Company or personal use level is open to everyone, businesses and consumers. The Team and Consultancy / White label levels are for businesses only: they cover several entities or deliverables handed to your clients.

• Company or personal use – $490 excluding taxes ($588 including 20% VAT for a consumer in France): one entity, all its staff and sites; copy, adapt and share the workbook, the guide and the templates internally; resale, redistribution outside the entity and publication prohibited; 12 months of updates; also open to consumers, for personal use.
• Team – $990, businesses only: up to 5 entities of the same group, a public body with its affiliated bodies, or the same consortium, each with the Company rights; 45-minute onboarding video call; reply within 2 working days.
• Consultancy / White label – $1,990, businesses only: you adapt the workbook, the guide and the Word templates to produce deliverables for your own clients (unlimited) under your own brand and hand them the adapted files; reselling, redistributing or publishing the template itself is prohibited; 45-minute video call, reply within 2 working days.

Which one is for you? Company or personal use if you are bringing your own entity into compliance. Team for a group, or a public body with its affiliated bodies (5 entities at most). Consultancy / White label if you are a cybersecurity firm, an IT services company or a consultant handing several clients a self-assessment, an action plan and policies adapted to them, under your brand. Consumers: Company or personal use, for personal use; the other levels are not open to them.

More than five entities, firm networks, software or training use: message the MOE CAPITAL Digital LinkedIn page. Team or White label license: at checkout, enter the legal name and the registration or VAT number of the licensed entity (required for these levels; if it is missing, we ask for it by e-mail; optional for the Company or personal use level). Full license terms available before purchase at lesbonsmots.gumroad.com/license-terms; the PDF is attached to every purchase. Prices exclude taxes: Gumroad, the reseller, adds VAT or sales tax at checkout according to the buyer's country.

Consumers: 14-day right of withdrawal from purchase, even after download and whatever the level ordered, with a refund within 14 days : Withdraw from contract here; two-year statutory guarantee of conformity; consumer mediator: Société de la Médiation Professionnelle (SMP), Alteritae, 5 rue Salvaing, 12000 Rodez, France – www.mediateur-consommation-smp.fr. Terms of Service: lesbonsmots.gumroad.com/terms.

Publisher: SASU MOE CAPITAL (MOE CAPITAL Digital brand), which operates the "Les bons mots" shop: 95 impasse des Garennes, 81710 Saïx, France, Castres Trade and Companies Register 979 936 085, [email protected]. Gumroad, the reseller, takes the payment.

Company or personal use level details below.