Kit de resiliencia digital UE (DORA y NIS2)
Cumplir DORA y NIS2: marco de riesgo TIC, registro de terceros, notificación de incidentes graves, obligaciones de producto CRA y pruebas basadas en amenazas.
11 plantillas en 5 pasos, en el orden en que se usan. Abre cualquier plantilla en el editor, complétala y expórtala a PDF, DOCX o HTML.
Planteamiento
NIS2 Cybersecurity Risk-Management Measures Template (Article 21)
CompletaNIS2 classification, jurisdiction, management duties, measures (a) to (j) mapped to CIR 2024/2690, incident reporting, supply chain, metrics, transposition
Directive (EU) 2022/2555 (NIS2) Art. 20, 21, 23; Implementing Regulation (EU) 2024/2690; ENISA guidance v1.0 (June 2025)DORA ICT Risk Management Framework Template
CompletaDORA ICT risk management framework: Article 5 governance, Article 6(8) strategy, risk tolerance, RTS 2024/1774 policy map, review report, traceability
DORA (EU) 2022/2554 Arts 5-16; Delegated Reg (EU) 2024/1774
Compras y proveedores
DORA Register of Information Template (ICT Third-Party Arrangements)
CompletaDORA Art. 28(3) register: templates B_01.01 to B_99.01, arrangements, providers and LEI/EUID, supply chain ranks, functions, assessments, concentration, exit
Regulation (EU) 2022/2554 (DORA) Art. 28 to 30; Implementing Regulation (EU) 2024/2956Supplier Security Assessment Template
EstándarSupplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision
ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I
Incidentes
Incident Response Plan Template (NIST SP 800-61 Rev. 3)
CompletaIR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics
NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14DORA Major Incident Report Template (Classification, Art. 19)
CompletaDORA major ICT incident: classification thresholds, reporting clock, initial, intermediate and final report fields (ITS Annex I), client notice, cyber threats
DORA Art. 19; Delegated Reg. (EU) 2024/1772, 2025/301; Implementing Reg. (EU) 2025/302Security Incident Report Template (NIST SP 800-61 Rev. 3)
CompletaIncident record and report: awareness, timeline, impact, evidence custody, ATT&CK analysis, actions, GDPR/NIS2/CRA/DORA/SEC clocks, CSF 2.0 lessons
NIST SP 800-61 Rev. 3 (2025); NIST CSF 2.0; GDPR Art. 33; NIS2 Art. 23; CRA Art. 14; DORA Art. 19
Productos
CRA Technical Documentation and EU Declaration of Conformity Template
CompletaEU CRA Annex VII file: product, design, Art. 13 risk assessment, Annex I checklist, support period, standards, tests, SBOM, Art. 32 module, Annex V DoC
Regulation (EU) 2024/2847 (Cyber Resilience Act) Annex I, V, VII; Art. 13, 32CRA Vulnerability Handling and Reporting Procedure Template
CompletaEU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline
Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP
Ensayos y pruebas
Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)
CompletaDiscussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan
CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84Red Team Engagement Plan Template (TIBER-EU, DORA TLPT)
CompletaThreat-led red team plan: CIF scope and flags, control team, scenarios, rules of engagement, risks, timeline, replay and purple teaming, remediation
TIBER-EU (Jan 2025); DORA Art. 26 and 27; Delegated Regulation (EU) 2025/1190