Get your organisation ready for NIS2 and Cyber Essentials in 90 days, with evidence
For IT directors, security and compliance leads in organisations of 50 to 1,000 people: a 23-sheet workbook, 5 fillable forms, brand-ready templates and an e-book that follows one logistics company from the new law to a tested programme.
- A 23-sheet workbook: applicability test, 0-4 self-assessment of 28 practices, ranked gap plan, Cyber Essentials checklist, incident reporting clock and a dashboard with five charts
- 14 policy starters, an incident response and reporting playbook, and a board briefing and sign-off memo
- 5 fillable forms for scoping and registration, Cyber Essentials readiness, significant incidents, supplier assessments and board training
- 32 messages, 26 AI prompts, a 45-minute team briefing and a 14-question LMS-ready knowledge check
The NIS2 and Cyber Essentials Readiness Kit · Bodhih Pro Kits · 320 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do you get ready for NIS2 and Cyber Essentials?
Test each legal entity for scope, put the decision and training with the board, score your practices honestly, close the gaps in priority order, control supplier access, rehearse the 24-hour reporting clock and keep the evidence. The NIS2 and Cyber Essentials Readiness Kit from Bodhih Training gives you the files for each step.
Want the full free guide first? Read How to prepare for NIS2 and Cyber Essentials: a 90-day method.
You already feel the problem. Here is what it is costing you.
A law with your board's name on it
The management body must approve the measures, oversee them and take training. You need to brief directors clearly and record what they decided.
Nobody is sure what you are
Essential, important or out? One legal entity runs three businesses, and only one of them is obviously in the Annexes.
A 24-hour clock nobody has rehearsed
If ransomware hits on a Sunday morning, who decides it is significant, and who sends the early warning by Monday?
A UK tender wants a certificate
Cyber Essentials Plus by a fixed date, with unsupported PCs and cloud services that have MFA switched off.
Picture the next few weeks with the kit open beside you.
Imagine day 90. You open the Dashboard and read, in numbers and colours, how far maturity has moved, which gaps remain and who owns them, whether every incident report went on time and which board member still needs training.
As you print the day-90 sign-off, notice how few of the questions are hard now. Which entity type you are, and why. When the board approved the measures. Where the restore test record lives. Which suppliers can reach you, and through what.
When the next customer asks whether you are 'NIS2 compliant', open the Message Library and send the honest answer: what you are, what the board approved and how you check it.
Whether you start with the Applicability worksheet tonight or the Self-assessment at Monday's meeting, the Start-here map tells you which file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The NIS2 and Cyber Essentials Readiness Kit (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: NIS2 and Cyber Essentials readiness map
The job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan, the 'Brand it in five minutes' box and what is in the kit.
NIS2 and Cyber Essentials Readiness Workbook
23-sheet workbook: Settings, applicability, 0-4 self-assessment of 28 practices with a ranked gap-to-action plan, Cyber Essentials checklist and scope, evidence register, incident log with the 24-hour and 72-hour reporting clock, suppliers, risks, board training, hardening trend, RACI, 90-day roadmap, crosswalk, national transposition, official sources, glossary, What changed log and a dashboard with five charts and traffic lights.
NIS2 and Cyber Essentials business case calculator
Five-sheet calculator: your inputs, the cost of doing it in years 1 and 2, three scenarios for the cost of doing nothing (expected incident cost plus contract margin at risk) and a dashboard with two charts.
NIS2 applicability and registration worksheet
Three-page fillable worksheet: the sector and size test for each entity, the entity type with the reasons, and the registration details your national authority asks for.
Cyber Essentials and Plus readiness checklist
Three-page fillable checklist for the organisation you will certify: scope decisions, the five control themes with evidence, and the Plus test plan and decision to apply.
Significant incident decision and reporting record
Four-page fillable record for the worst week of the year: the first hour, the significance decision, the three NIS2 reports (early warning, notification, final), the personal data decision and a blameless post-incident review.
Supplier and MSP security assessment form
Three-page fillable form for one critical supplier or managed service provider: what they touch, the assurance they hold, the contract terms and the decision.
Board cyber briefing and training record
Three-page fillable record for the management body: the briefing agenda, the questions directors should ask, attendance and the approval of the risk-management measures.
NIS2 and Cyber Essentials policy pack
14 brand-ready policy and procedure starters covering the ten NIS2 risk-management themes and the five Cyber Essentials controls, each with rules, owners and the evidence it creates.
Incident response and reporting playbook
Brand-ready playbook: roles and 24/7 contacts, significance rules, the NIS2 reporting stages with what each report contains, a four-phase response from the first hour to the final report, report wording starters and the other clocks that may run at once.
Board briefing and leadership sign-off memo
Brand-ready four-part template: the board briefing paper with duties, position, options and decisions; the decision memo and sign-off; the day-90 sign-off checklist; and the one-page quarterly board report.
NIS2 and Cyber Essentials message library
32 brand-ready messages for the board, authorities, suppliers and MSPs, staff, customers, certification bodies and tenders.
Worked example pack: Delta Maas Logistics
The kit's main files completed for one composite 400-person logistics company in Rotterdam with a UK subsidiary: classification, board decision and business case, self-assessment, gap plan, Cyber Essentials Plus, a full incident reporting record, a supplier review, board training and evidence.
AI prompt pack for NIS2 and Cyber Essentials
26 prompts with placeholders grouped by step (scope, assess, board, measures, suppliers, incidents, certify, other markets, staff), each with what to paste in, what to check, and four human-review rules.
Team briefing session plan and answer key
A 45-minute briefing plan for office, depot and field staff, facilitator notes, guidance for the separate board session, LMS import notes, the printable answer key for the 14-question knowledge check and an attendance record.
NIS2 and Cyber Essentials knowledge check (LMS-ready)
14 scenario questions with four options, the correct letter and an explanation; imports into Bodhih LMS or any LMS that accepts CSV quizzes.
Numbers that matter: NIS2 and Cyber Essentials KPI card
14 numbers with plain-words definition, formula, where each lives and what to do when it moves, plus a flow mini-infographic.
NIS2 decision card and mistakes to avoid
Twelve 'if this, do that' decisions with the file to open, the path in one line and fifteen mistakes with what to do instead.
Incident reporting clock card
The NIS2, GDPR and proposed UK clocks on one page, the sample incident on one timeline, the first-hour checklist and significance in plain words.
NIS2, Cyber Essentials and national rules (November 2026)
Dated sheet: NIS2 articles and proposed changes, national transposition, the UK position including the Cyber Security and Resilience Bill and Cyber Essentials fees, and Australia, the US, Canada and New Zealand.
NIS2 90-day hardening plan calendar
26 calendar events starting Monday 04 January 2027 (move the series to your own kick-off in your calendar app): thirteen weekly programme meetings, registration, MFA, supplier review, tabletop, restore test, monthly evidence hours, quarterly board reports, Cyber Essentials renewal and the yearly review.
NIS2 task board (CSV import)
40 tasks with phase, owner role, start and end week, labels and notes; imports into Trello, Asana, Planner, Jira, Notion or a spreadsheet.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 73 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira, Bodhih LMS and most LMS quiz importers
- Best for
- Mid-size organisations of 50 to 1,000 people in NIS2 sectors, and groups needing UK Cyber Essentials
- Review date
- November 2026, with a dated sheet and a What changed log
What NIS2 and Cyber Essentials ask, in plain words
Articles 20, 21 and 23 in plain words, where Cyber Essentials fits, and why to build now whatever your country's timetable.
Scope: sectors, size and your entity type
The sector, size and size-independent tests, classifying the whole entity, essential versus important, and registration.
The gap assessment: score what you can show
A 0-4 maturity self-assessment of 28 practices and a gap-to-action plan ranked by gap x impact.
The board: accountability, training and the business case
What the management body must do, board training, and an honest business case with the low case first.
The ten measures as one working programme
The ten Article 21 measures as 14 owned, approved policies, including operational technology.
Cyber Essentials and Plus: five controls done properly
Scope, the five controls, the April 2026 MFA rule, Plus rehearsal, fees and timing.
Suppliers and managed service providers
Supplier register, assessments, controlling supplier and MSP access, and contract terms.
Incident reporting: from the first alert to the final report
Significance, the 24-hour early warning, 72-hour notification and one-month final report, and the GDPR clock alongside.
The 90-day hardening plan and the evidence
The 90-day plan, the weekly rhythm, the evidence register, the Dashboard and the day-90 sign-off.
Other markets, AI in the job and staying ready
The UK Bill, Australia, the US, Canada and New Zealand, AI with human review, and the quarterly cycle.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-NIS2-and-Cyber-Essentials-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, a 30/60/90-day plan and the 'Brand it in five minutes' box
Workbooks
- NIS2-and-Cyber-Essentials-Readiness-Workbook.xlsx: 23 sheets including Settings, applicability, a 0-4 self-assessment of 28 practices, ranked gap plan, Cyber Essentials checklist and scope, evidence register, incident log with the reporting clock, suppliers, risks, board training, hardening trend, RACI, roadmap, crosswalk, national transposition, official sources, glossary, What changed and a dashboard with five charts and traffic lights
- NIS2-Business-Case-Calculator.xlsx: 5 sheets comparing the cost of doing nothing in three scenarios with the cost of doing it in years 1 and 2
Fillable forms
- NIS2-Applicability-and-Registration-Worksheet.pdf: the sector and size test per entity, the result with reasons, and the registration details
- Cyber-Essentials-Readiness-Checklist.pdf: scope, the five control themes with evidence, and the Plus rehearsal
- Significant-Incident-Decision-and-Reporting-Record.pdf: the first hour, the significance decision, the three reports, the personal data decision and a blameless review
- Supplier-Security-Assessment-Form.pdf: what a supplier or MSP touches, its assurance, contract terms and the decision
- Board-Cyber-Briefing-and-Training-Record.pdf: briefing agenda, questions directors should ask, attendance and approval of the measures
Word templates
- NIS2-and-Cyber-Essentials-Policy-Pack.docx: 14 brand-ready policy and procedure starters covering the ten NIS2 measures and the five Cyber Essentials controls
- Incident-Response-and-Reporting-Playbook.docx: roles, significance rules, the reporting stages, a four-phase response and report wording
- Board-Briefing-and-Leadership-Sign-Off-Memo.docx: board paper, decision memo, day-90 sign-off and the one-page quarterly report
- NIS2-and-Cyber-Essentials-Message-Library.docx: 32 messages for the board, authorities, suppliers, staff, customers and certification bodies
- Worked-Example-Pack-Delta-Maas-Logistics.docx: the main files completed for one composite 400-person logistics company
- AI-Prompt-Pack-for-NIS2-and-Cyber-Essentials.docx: 26 prompts with what to paste in, what to check and four human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute session plan, facilitator notes, board session guidance and the printable answer key
Cheat sheets
- Numbers-That-Matter-NIS2-and-Cyber-Essentials.pdf: 14 numbers with formulas and what to do when they move
- NIS2-Decision-and-Mistakes-Cards.pdf: twelve decisions and 15 mistakes to avoid
- Incident-Reporting-Clock-Card.pdf: every reporting clock on one page with the first-hour checklist
- NIS2-Cyber-Essentials-and-National-Rules-November-2026.pdf: the dated sheet for the EU, member states, the UK, Australia, the US, Canada and New Zealand
Training, calendar and import
- NIS2-Knowledge-Check.csv: 14 scenario questions, LMS-ready
- NIS2-90-Day-Hardening-Plan.ics: 26 calendar events for the 90 days and the year after
- NIS2-Task-Board.csv: 40 tasks for Trello, Asana, Planner, Jira or Notion
E-book
- The NIS2 and Cyber Essentials Readiness Kit e-book: about 10,500 words, 10 chapters and 23 figures
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Classify each legal entity as essential, important or out, with written reasons and the registration facts ready
- Brief your board on its duties, record its approval and training, and present an honest business case
- Score 28 practices on a 0-4 scale and work a gap plan ranked by gap x impact
- Approve 14 policies that match how you actually work, with evidence for each
- Prepare a subsidiary or the whole organisation for Cyber Essentials and Plus, including the April 2026 MFA rule
- Assess critical suppliers and managed service providers and control their access
- Decide significance and send the 24-hour early warning, 72-hour notification and final report on time
- Run a 90-day plan and a quarterly cycle that keep the evidence current
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Workplace Cybersecurity Awareness Assessment for Annual Recertification of All Staff
Take the assessment →AssessAll assessmentIncident Response & On-Call Judgment
Take the assessment →AssessAll assessmentThird-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams
Take the assessment →JobularySet goals you actually reach with the WOOP method (Jobulary)
Make it a growth plan →A taste of Chapter 8
At 08:15, Tomas and Marieke decided the incident was significant: the barge service could not plan sailings, and that was severe disruption by their own rule. They sent the early warning to the national CSIRT at 15:10, 8.5 hours after becoming aware, saying what they knew, that the act was clearly malicious, and that cross-border impact was possible because two sailings were bound for Germany. Daan restored both servers from the immutable backup that had been tested on 2 October. Sailings were planned by hand for nine hours; 14 were delayed and none cancelled. The incident notification went on Tuesday at 11:30, 52.8 hours after becoming aware, with an initial severity assessment and the indicators of compromise the managed detection service had found. The crew rosters on the servers were personal data; Marieke and the DPO assessed it, found no sign of access and a same-day restore, recorded the decision and did not notify.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Scope | A sector list to read | A per-entity applicability sheet with size arithmetic, an entity result that takes the highest line, and a worksheet for the reasons and registration |
| Where you stand | A checklist of yes and no | A 0-4 self-assessment of 28 practices with level descriptors, gap x impact priority and a self-ranking gap plan |
| The board | A slide saying directors are liable | A board paper, decision memo, training record, day-90 sign-off and one-page quarterly report |
| Incident reporting | The three deadlines in a table | A playbook, a decision and reporting record, and an incident log that calculates each deadline and flags late reports |
| Cyber Essentials | The five control names | A 23-check readiness checklist, a scope sheet that flags unsupported devices and missing MFA, and a Plus rehearsal |
| Compared with a consultant or a compliance platform | A consultant brings judgement and capacity; a platform automates evidence collection | The method, templates and workbook to run it yourself or to brief either well; you still need counsel for scope and specialists for testing |
Made for you if…
- IT directors and heads of security at mid-size organisations that a national NIS2 law now covers
- Compliance and legal leads who must classify the entity, register it and brief the board
- Operations directors in transport, logistics, utilities, manufacturing and other listed sectors with operational technology
- Groups with a UK subsidiary or UK customers that ask for Cyber Essentials or Cyber Essentials Plus
- Managed service providers preparing for NIS2 or the UK Cyber Security and Resilience Bill
- Consultants and fractional CISOs who want a brandable starting kit for a client (within the licence)
Probably not for you if…
- Anyone wanting legal advice: national law decides how NIS2 applies, and your counsel should confirm scope
- Anyone wanting a certificate: only an IASME-licensed certification body issues Cyber Essentials, and there is no NIS2 certificate
- Organisations that need a full certified ISMS: the ISO/IEC 27001 Implementation Toolkit covers that
- Financial entities whose ICT duties come mainly from sector rules
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your NIS2 and Cyber Essentials programme, in one place
Open the Start-here map and give it one hour. Whether you begin with the Applicability worksheet tonight or the board paper next week, you will know what to do next and which file to open. Not affiliated with or endorsed by the European Commission, ENISA, the NCSC or IASME.
Personal licence for the buyer's own use, including use within your own organisation and with its staff and board. Please don't share or resell the files. Team, company and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Third-Party and Vendor Security Risk Kit
Run third-party security and privacy risk management in a small or mid-size company.
The Ransomware and Cyber Incident Response Playbook
Prepare a small or mid-size organisation to respond to ransomware and other cyber incident.
The Psychosocial Risk Management Kit
Identify, assess and control psychosocial hazards at work as a health-and-safety duty, not.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The NIS2 and Cyber Essentials Readiness Kit: FAQs
Read the free guideAlready bought? Resend my linkWill this kit make my organisation NIS2 compliant?
No kit can, and no certificate makes an organisation 'NIS2 compliant'. Your national law and supervisor decide what applies and whether you meet it. The kit helps you scope, decide, assess, build and evidence the measures, report incidents on time and show your board's oversight. It is not legal advice.
How do I know if NIS2 applies to my company?
Run three tests per legal entity: does any activity match an entity type in Annex I or Annex II; is the enterprise medium or large under the EU SME definition; and does a size-independent case apply. Large Annex I entities are usually essential, other in-scope entities important. The Applicability sheet does the arithmetic; counsel and your national law confirm it.
What is the difference between an essential and an important entity?
The measures and reporting duties are the same. Essential entities can be supervised before anything goes wrong, with inspections and audits, and face higher maximum fines (at least EUR 10 million or 2% of worldwide turnover). Important entities are supervised mainly after evidence of a problem (at least EUR 7 million or 1.4%).
What are the NIS2 incident reporting deadlines?
For a significant incident: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. A personal data breach may also need reporting under the GDPR or UK GDPR. The playbook, the incident record and the clock card cover all of it.
Our country hasn't finished its NIS2 law. Should we wait?
No. National laws follow the Directive closely on scope, the board, the measures and the reporting clock. Build the measures now and keep the national detail in the dated Transposition sheet. In mid-2026 the Commission referred four member states to the Court of Justice for late transposition, so timetables vary but the direction does not.
Do I need Cyber Essentials if NIS2 applies to us?
NIS2 does not require it. UK buyers often do: IASME says it is required in many central government contracts. Cyber Essentials Plus is also good, independently tested evidence for part of the NIS2 measures (hygiene, patching, access and MFA). The kit covers both because they overlap.
How much does Cyber Essentials cost and how long does it take?
IASME lists fees by size excluding VAT, from GBP 320 for micro organisations to GBP 600 for 250 staff or more; Plus is quoted by the certification body. Certificates last 12 months. In the worked example a 60-person subsidiary went from 3 of 23 checks met to certified Plus in about seven weeks. Check current fees on the dated sheet.
How long does it take to get ready for NIS2?
It depends on your starting point. The kit's plan is 90 days to a tested programme with board approval, then a quarterly cycle. In the worked example, average maturity rose from 0.64 to 2.61 out of 4 in 13 weeks, with five Medium gaps still open on day 90.
Can we do NIS2 readiness without a consultant?
Many mid-size organisations can run the programme themselves with this kit, using counsel for the scope decision and contract terms, and specialists for testing. The kit tells you where outside help matters, and the business case calculator lets you price it.
Can I use this with my team and board?
Yes, within your own organisation under the personal licence: brief your board, train your staff, import the knowledge check into your LMS and share the templates internally. Company, multi-site and consultant licences are available from solutions@bodhih.com.
Does it work in my country?
The method works anywhere. The dated sheet and the Crosswalk cover the EU and selected member states, the UK (including the Cyber Security and Resilience Bill and Cyber Essentials), Australia, the US, Canada and New Zealand at November 2026. Laws and fees change, so check the official source and your adviser.
How can I measure my team's starting point and plan my own development?
To measure where your staff and responders stand, AssessAll offers the Workplace Cybersecurity Awareness Assessment, Incident Response and On-Call Judgment and the Third-Party and Vendor Assurance Assessment. To turn your own goals for the programme into a plan you keep, Jobulary's guide to the WOOP method is a practical start.
How much does The NIS2 and Cyber Essentials Readiness Kit cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
