Skip to main content
Use this page to browse the NIS2 playbooks and import them into your tenant as compliance checks. It is for MSP staff. NIS2 is Directive (EU) 2022/2555. It applies to essential and important entities in the sectors listed in its annexes, and it reaches their suppliers through contract terms. Each EU Member State applies it through national law, so confirm the national rules for each client.

​
Before you start

  • You need Playbooks management permission and active billing to import. Read access lets you look at the catalog.
  • Import permission is separate from read access. Without it, you see You do not have permission to add playbooks.

​
Find the NIS2 playbooks

1

Open Playbooks

Open Settings > Compliance > Playbooks.
2

Open Security Frameworks

Choose Security Frameworks, then NIS2. The page groups ten playbooks by article.
3

Start with scope and governance

Open the scope and governance playbook first. It records whether the client is an essential entity, an important entity, or a supplier to one. That answer decides how the other playbooks apply.

​
Review the checks

1

Open a playbook

Click a playbook title to read its check list.
2

Read a check

Every check title starts with its article reference, such as Art. 21(2)(c) or Art. 23(4)(a). Each check includes how to check, why it matters, remediation, expected evidence, and cross-references to the implementing regulation, ISO/IEC 27001, CIS Controls, and NIST CSF where they apply.
3

Close the details

Close the details when you finish. The Copy button in the details opens the same Add Playbooks to Tenant dialog as Add on the playbook’s card, so continue with the steps below.

​
Import playbooks

1

Choose what to import

Click Add on one playbook. To import several, tick them and click Add to Tenant (N) in the page header.
2

Check the destination

In Add Playbooks to Tenant, review the Folder for each playbook. The default is a NIS2 folder with one subfolder per playbook.
3

Choose a status list

Pick a Status list for each selected playbook.
4

Check for playbooks already imported

A playbook you already imported shows Already in your tenant. Importing again adds only the checks that are missing and keeps your existing checks unchanged. It does not create a second copy.
5

Import

Click Add to Tenant. MSPortal shows Playbook(s) added, or imported. Find its checks in Compliance under "".
6

Check the result

Open Settings > Compliance > Checks and look in the destination folder. Open Groups to find the new group.
NIS2 checks are company-level checks, so the dialog suggests no device types.

​
Prepare an assessment

Tailor the imported checks to the client’s Member State. Replace the generic references to the national authority and CSIRT with the client’s real bodies and portal, and adjust thresholds where national law sets them. Then set up groups, runs, and company scope in Compliance settings. The playbooks give structure to a review. They do not decide a client’s legal status, replace legal advice, or certify compliance.

​
Troubleshooting

​
Frequently asked questions

No. They follow the directive text. Add or adjust checks for national rules after import.
Yes. The scope playbook includes a check for suppliers to NIS2 entities, and the Article 21 playbooks work as a general security review.
No. NIS2 is EU law. NIST CSF 2.0 is a voluntary US framework. Many NIS2 checks cross-reference NIST CSF 2.0 categories.
Importing again adds checks that are missing from your copy, such as new checks in the catalog, to the existing group. It does not update checks you already have, so review edited checks against the catalog yourself.