Markdown Editor
Open the editor

EU Digital Resilience (DORA and NIS2) Kit

Meet DORA and NIS2: ICT risk framework, third-party register, major incident reporting, CRA product duties and threat-led testing.

11 templates in 5 steps, in the order you use them. Open any template in the editor, fill it in and export it to PDF, DOCX or HTML.

Step 1

Framing

  1. NIS2 Cybersecurity Risk-Management Measures Template (Article 21)

    Full

    NIS2 classification, jurisdiction, management duties, measures (a) to (j) mapped to CIR 2024/2690, incident reporting, supply chain, metrics, transposition

    Directive (EU) 2022/2555 (NIS2) Art. 20, 21, 23; Implementing Regulation (EU) 2024/2690; ENISA guidance v1.0 (June 2025)

  2. DORA ICT Risk Management Framework Template

    Full

    DORA ICT risk management framework: Article 5 governance, Article 6(8) strategy, risk tolerance, RTS 2024/1774 policy map, review report, traceability

    DORA (EU) 2022/2554 Arts 5-16; Delegated Reg (EU) 2024/1774
Step 2

Sourcing

  1. DORA Register of Information Template (ICT Third-Party Arrangements)

    Full

    DORA Art. 28(3) register: templates B_01.01 to B_99.01, arrangements, providers and LEI/EUID, supply chain ranks, functions, assessments, concentration, exit

    Regulation (EU) 2022/2554 (DORA) Art. 28 to 30; Implementing Regulation (EU) 2024/2956

  2. Supplier Security Assessment Template

    Standard

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I
Step 3

Incidents

  1. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Full

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  2. DORA Major Incident Report Template (Classification, Art. 19)

    Full

    DORA major ICT incident: classification thresholds, reporting clock, initial, intermediate and final report fields (ITS Annex I), client notice, cyber threats

    DORA Art. 19; Delegated Reg. (EU) 2024/1772, 2025/301; Implementing Reg. (EU) 2025/302

  3. Security Incident Report Template (NIST SP 800-61 Rev. 3)

    Full

    Incident record and report: awareness, timeline, impact, evidence custody, ATT&CK analysis, actions, GDPR/NIS2/CRA/DORA/SEC clocks, CSF 2.0 lessons

    NIST SP 800-61 Rev. 3 (2025); NIST CSF 2.0; GDPR Art. 33; NIS2 Art. 23; CRA Art. 14; DORA Art. 19
Step 4

Products

  1. CRA Technical Documentation and EU Declaration of Conformity Template

    Full

    EU CRA Annex VII file: product, design, Art. 13 risk assessment, Annex I checklist, support period, standards, tests, SBOM, Art. 32 module, Annex V DoC

    Regulation (EU) 2024/2847 (Cyber Resilience Act) Annex I, V, VII; Art. 13, 32

  2. CRA Vulnerability Handling and Reporting Procedure Template

    Full

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP
Step 5

Rehearse and test

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Full

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84

  2. Red Team Engagement Plan Template (TIBER-EU, DORA TLPT)

    Full

    Threat-led red team plan: CIF scope and flags, control team, scenarios, rules of engagement, risks, timeline, replay and purple teaming, remediation

    TIBER-EU (Jan 2025); DORA Art. 26 and 27; Delegated Regulation (EU) 2025/1190