NIS2 Documentation: Which Documents Are Mandatory?

The BSIG explicitly requires you to document compliance with the risk management obligation (§30(1) sentence 3), but it names no fixed list of documents. What you need to evidence are the ten minimum measures in §30(2). If documentation is missing, fines of up to EUR 7 million (important entities) or EUR 10 million (essential entities) are possible. NIS2Compass maps templates to these provisions.

What documentation does NIS2 legally require?

The BSIG contains an explicit documentation obligation: under §30(1) sentence 3, entities must document their compliance with the risk management obligation. The law does not say which documents this means. A breach is subject to a fine under §65(2) no. 3, even if all measures have been implemented.

According to the wording, compliance must be documented "by the entities" (BGBl. 2025 I Nr. 301). This is the only explicit documentation obligation in risk management. The ten minimum measures in §30(2) speak of concepts, processes and procedures, but name no particular document type or form. §30 contains no general obligation to have a policy, a BCM plan or an emergency manual.

The scope is set by proportionality under §30(1) sentence 2: risk exposure, size, implementation costs, likelihood of occurrence, severity, and societal and economic impact. A company with 90 employees does not need the binder of a large group.

The explanatory memorandum to the government bill (Bt-Drs. 21/1501, p. 148) compares the obligation to the accountability principle in Art. 5(2) GDPR. Entities should be able to present evidence documents to the BSI under §61(3). As non-exhaustive examples, it names internal policies, checklists, information sheets and audit reports, among others.

BSI interpretation: The BSI FAQ gives internal documentation, reports, training records and audit reports as examples of possible evidence. Processes, responsibilities and security measures should be put in writing and reviewed regularly.

Do not mix up these obligations:

• Risk management measures (documentation obligation): The implementation must be documented, and the form is free (§30(1) sentence 3).
• Security incidents (submission obligation): Report within 24 hours, then within 72 hours, an interim report on request, and a final report no later than one month after the 72-hour report. If an incident is still ongoing, a progress report comes first (§32(1) and (2)). The report you submit is itself the document.
• Registration (submission obligation): Details to the BSI no later than three months after classification (§33(1)). Practice: file the classification decision and the confirmation internally.
• Management (duty of the management): Implement and oversee the measures (§38(1)) and attend training (§38(3)). The wording does not require proof. In practice you need it, because the BSI can check the training obligation.

The fine provisions stand side by side: if you have implemented everything but evidenced nothing, you are not in the clear (§65(2) no. 3, (5)). The range quoted is a maximum, not a standard penalty. Details are in the overview of the fine tiers and in §65 BSIG.

Which documents do you need in practice to evidence the ten minimum measures?

For each of the ten minimum measures in §30(2) BSIG, you should have a document that shows the concept, the responsible person and the implementation. The law does not prescribe the respective document type. As evidence, the BSI FAQ names internal documentation, reports and training records as examples.

If you cannot evidence a measure in writing, you will struggle to meet the documentation obligation in §30(1) sentence 3. The mapping below is practice, not an official list. The names of the measures follow the statutory text in spirit, and the templates are one example per number from the NIS2Compass Template Library.

• No. 1, risk analysis and information system security: Risk analysis with assessment and decisions, plus a security concept. Example: NIS2 Threat Analysis & Risk Matrix (Excel).
• No. 2, security incident handling: Incident handling policy, incident register, exercise records. Example: Incident Response Policy (Word).
• No. 3, business continuity, backup and crisis management: Business impact analysis, emergency manual, backup concept, restore tests. Example: NIS2 Business Impact Analysis (BIA) (Excel).
• No. 4, supply chain security: Supplier register, assessment, contract clauses. Example: Supplier Security Policy (Word).
• No. 5, acquisition, development and maintenance, including vulnerability management: Patch concept, vulnerability register, network concept. Example: Patch Management Policy (Word).
• No. 6, assessing effectiveness: Audit plans, internal audits, exercise results. Example: NIS2 Gap Assessment (Excel) with its own sheet for effectiveness assessment.
• No. 7, training and awareness: Training plan and attendance records. Example: NIS2 Training Evidence Register (Excel).
• No. 8, cryptography: Cryptography concept, key and certificate management. Example: Cryptography Policy (Word).
• No. 9, personnel, access control and ICT asset management: Access control concept, system inventory. Example: Access Control Policy (Word).
• No. 10, multi-factor authentication, secured communication, emergency communication: The catalog has no dedicated template here. It is best to document these procedures yourself, for instance as a section in the access control concept.

Every one of these documents needs a date, a version, an approval and a responsible person. Without them, you cannot show later who decided what and when. Ten lean, maintained documents prove more than twenty that nobody updates.

You will find further templates per number in the NIS2 template catalog. Which measures you actually have to implement is shown by the NIS2 checklist as an Excel template. This article is only about the evidence.

An information security policy works well as the top-level document. It is binding only for the entity types covered by Implementing Regulation (EU) 2024/2690, such as DNS providers, cloud providers and managed service providers (§30(3) BSIG). For everyone else it is practice.

An ISO 27001 or IT-Grundschutz certificate can make the evidence easier. According to the BSI FAQ, though, it must be checked against the statutory catalog of measures and supplemented where needed, as this article on ISO 27001 and NIS2 shows.

Who has to provide which evidence, and when?

Only operators of critical facilities have to provide evidence without being asked: they prove their measures under §39 BSIG every three years. For all other entities, the BSI can order audits and request documents during a review (§61 BSIG). For important entities, this requires a specific trigger (§62).

Operators of critical facilities are also subject to the additional requirements of §31 BSIG. Whether your company is essential, important or not affected at all is determined by the classification under §28; the applicability check clarifies that. There is no general NIS2 certificate. What evidence an audit delivers and what it costs is covered in the certification article.

Practical scenario: How does a manufacturer with 90 employees prepare its evidence binder?

A manufacturer with 90 employees in an Annex 2 sector is generally an important entity (§28(2) BSIG). It must document its measures, but does not have to submit evidence unprompted. Registration and reporting remain active obligations. A sensible approach is an evidence binder with an index organised by provision: classification, management, ten concepts, reporting process, review.

The following example is fictional and serves as an illustration. A manufacturer of electrical equipment (Annex 2 no. 5.3 BSIG) has 90 employees and operates no critical facility. The head of IT takes over NIS2 responsibility from a colleague who has left. She finds policies in three folders, training lists in HR and no mapping to provisions. She proceeds in five steps:

1. Classification and registration (§28, §33): She files the classification decision and the registration confirmation. The Classification Documentation template serves as the basis.
2. Management (§38): She secures the resolution on implementation and a training record for each member, for example with the Management Resolution NIS2 Compliance and the Management Training Record under §38(3) BSIG. The article on the management's training obligation explains training content and frequency.
3. Ten concepts under §30(2): Each document gets a date, a version and a responsible person. The order is set by the gap assessment: biggest gap first, not number 1 first. The article on doing a gap analysis yourself or hiring someone describes the approach.
4. Reporting process (§32): The deadlines are 24 hours, 72 hours and one month after the 72-hour report until the final report. The process is prepared with the Incident Notification Process Policy, and the Incident Register provides ongoing evidence of it. The reporting template under §32 BSIG shows what the reports contain.
5. Review: She enters review dates in the Policy Review Calendar and sets up an index sheet: which obligation, which document, where it is filed, current version, responsible person.

Whoever reviews the binder later finds, for each obligation, the document, its status and the responsible person in the index. That applies to the management as much as to the BSI in a specific case.

Should you create NIS2 documents yourself or use templates?

The law prescribes no form, so you can create all documents yourself or build on templates. Templates save structural work and map documents to provisions. They replace neither the adaptation to your company, nor the implementation of the measures, nor legal advice.

The explanatory memorandum to the government bill lists nine possible forms of documentation, including internal policies, checklists, information sheets and agreements (Bt-Drs. 21/1501, p. 148). There is no official model. Documents you write yourself are therefore just as permissible as purchased ones.

Writing them yourself offers a tailored fit. Your employees know the content because it describes their own processes. The downside is the time it takes: an ISB does not write ten concepts on the side.

Without a fixed framework, gaps appear in individual numbers of §30(2) and version states become inconsistent. If you write the documents yourself, first use a gap analysis to find out where the biggest gaps are.

Templates provide the structure for each obligation, including the mapping to provisions, in Word and Excel. The counterargument still stands, though: a template is not finished. If you file it unchanged, you have documented nothing of your own. The yardstick remains proportionality under §30(1) sentence 2.

Paper without real implementation remains a breach of §30(1) sentence 1. Templates are a working basis, not legal advice and not a promise of audit readiness.

NIS2Compass is a guide with a Template Library, and implementation happens in Word and Excel. There are two ways to get the templates:

• Template Library with Pro: 45+ Word and Excel templates, each mapped to an implementation step. Pro costs EUR 29 per month, can be cancelled monthly and also includes ongoing updates.
• Template Package: EUR 99 one-off, in German or English (each its own edition). The ZIP download runs through Lemon Squeezy, and you do not need an account on the platform. You receive the state as of the purchase date, and updates are available only with Pro. The package does not replace the subscription and includes no platform access.

You can find all templates with their provision mapping in the NIS2 template catalog.

How long do you have to keep documents, and how do you keep them up to date?

§30 BSIG names no retention period. According to the BSI FAQ, processes, responsibilities and security measures should be put in writing and reviewed regularly. As a rule of thumb (not a statutory requirement): keep every document version with its approval date, responsible person and review date for as long as it is relevant to operations or a possible audit.

Retention periods from other areas of law, such as tax, commercial or data protection law, may apply to individual records. Check these separately. Entity types covered by Implementing Regulation (EU) 2024/2690 must also specify in their policy which documents to retain and for how long.

Neither the law nor the BSI FAQ names a review cycle, so you set it yourself. Also revise documents after incidents, system changes and new suppliers, and have the management sign off the results in a management review. The "Policy Review Calendar" template (Excel) works well as a framework.

The law sets fixed deadlines only elsewhere: registration no later than three months after classification (§33 BSIG), the final report no later than one month after the 72-hour report, and, for an ongoing incident, a progress report first (§32).

According to the explanatory memorandum to the government bill (Bt-Drs. 21/1501), management training counts as regular if it is offered at least every three years. BSI interpretation: According to the BSI FAQ, this minimum interval is rarely sufficient.

Set up three things this week: an index sheet with one row per obligation from §§30, 32, 33 and 38, a column for "Version / Responsible / Next review", and a filing location for your classification decision.

Frequently Asked Questions

Do I have to have an information security policy?

No, the BSIG does not explicitly require one. §30(2) no. 1 calls for concepts on risk analysis and information technology security, and the policy is the usual framework for that. It is required as a binding document only by Implementing Regulation (EU) 2024/2690, and only for DNS providers, cloud providers, managed service providers and other entity types named there.

Do I have to submit NIS2 documents to the BSI?

No, only when the BSI orders it; operators of critical facilities are the exception. Reports under §32 and registration details under §33, however, you submit proactively. Who checks when, and what an audit costs, is covered in the certification article.

Is an ISO 27001 certificate enough as documentation?

No, it is not enough on its own, but it makes the evidence easier. According to the BSI FAQ, a certificate must be checked against the statutory catalog of measures and supplemented where necessary. The BSI information package on ISO 27001 sees gaps, for example in reporting obligations, registration and management duties. The answer in detail: Is ISO 27001 enough for NIS2 compliance?.

What happens if documentation is missing?

Missing or incomplete documentation is an administrative offence under §65(2) no. 3 BSIG, even if all measures have been implemented. The range is up to EUR 10 million for essential entities and up to EUR 7 million for important entities. That is a maximum; the BSI sets the amount case by case (see §65 BSIG: fine tiers).

How long do I have to keep documentation?

§30 BSIG names no retention period. As a rule of thumb, keep documents for as long as they relate to operations or possible evidence, and keep earlier versions. Retention periods from other areas of law, such as tax, commercial or data protection law, you check separately for the respective records.