SOC 2 policy templates and NIS2 Article 21 measures, filled in
SOC 2 and NIS2 ask for many of the same written policies: access control, incident response, backup, suppliers, change management and encryption. The ISO 27001 kit writes them once from your answers, in English, German, Spanish, French, Polish or Italian, and maps each policy to the SOC 2 criteria, the Annex A controls of ISO/IEC 27001 and the points of NIS2 Article 21(2).
Checked against the sources on 25 October 2026
AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)
Checked against the sources on 25 October 2026
SOC 2 in short
SOC 2 is a report, not a certificate: an independent CPA firm examines a service organization's controls against the AICPA's Trust Services Criteria and issues the report. A type 1 report covers the design of the controls at one date; a type 2 report also covers how they operated over a period. Security, the common criteria CC1 to CC9, is always in scope; availability, confidentiality, processing integrity and privacy are added when the service needs them.
NIS2 Article 21 in short
Under Article 21 of Directive (EU) 2022/2555, essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks. Paragraph 2 lists what the measures include at least:
- (a) policies on risk analysis and information system security;
- (b) incident handling;
- (c) business continuity, such as backup management, disaster recovery and crisis management;
- (d) supply chain security;
- (e) security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure;
- (f) policies and procedures to assess whether the measures work;
- (g) basic cyber hygiene and cybersecurity training;
- (h) cryptography and, where appropriate, encryption;
- (i) human resources security, access control and asset management;
- (j) multi-factor or continuous authentication and secured communications, where appropriate.
Article 23 adds the reporting of significant incidents to the CSIRT or competent authority: an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours, and a final report within one month of the notification. Whether an organization is an essential or important entity is decided by the national law that transposes the Directive.
What the kit writes
| Files | What they hold |
|---|---|
| 07 to 13 | Seven policies: acceptable use, access control, change management, incident response, supplier security, backup and business continuity, cryptography. Each has its purpose, scope, rules, owner, exceptions, review interval and a table of its SOC 2 criteria, Annex A controls and NIS2 points. |
| 14 | SOC 2 criteria worksheet: the criteria by number with our own topic words, for Security and the categories you tick, with columns for your controls and the evidence an auditor can inspect; also as CSV. |
| 15 | NIS2 Article 21 record: each of the ten points quoted from the Official Journal in the language of the document, the kit files that address it, and the status of its Annex A controls taken from your Statement of Applicability; then the deadlines of Article 23(4). Under each point, ENISA's mapping (version 1.2, CC BY 4.0) of the matching points of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022. |
| 00 to 06 | Read me first, then the ISO 27001 core: scope, information security policy, risk assessment and register, treatment plan, Statement of Applicability of the 93 Annex A controls, objectives. |
All of these files come with one purchase of the ISO 27001 starter kit, for one organization.
Which policy covers what
| Policy | SOC 2 criteria | ISO/IEC 27001 Annex A | NIS2 Article 21(2) |
|---|---|---|---|
| Acceptable use policy | CC1.1, CC2.2 | 5.10, 6.3, 6.7, 8.1 | points (g), (i) |
| Access control policy | CC6.1, CC6.2, CC6.3 | 5.15, 5.16, 5.17, 5.18, 8.2, 8.3, 8.5 | points (i), (j) |
| Change management policy | CC8.1 | 8.8, 8.25, 8.31, 8.32 | point (e) |
| Incident response policy | CC7.3, CC7.4, CC7.5 | 5.24, 5.25, 5.26, 5.27, 5.28, 6.8 | point (b) |
| Supplier security policy | CC9.2 | 5.19, 5.20, 5.21, 5.22, 5.23 | point (d) |
| Backup and business continuity policy | CC9.1, A1.2, A1.3 | 5.29, 5.30, 8.13, 8.14 | point (c) |
| Cryptography policy | CC6.1, CC6.7 | 8.24 | point (h) |
These references are our own reading of where each policy helps; they are not an auditor's mapping and do not show that a criterion or a measure is met.
What the kit does not do
It does not contain the text of the AICPA criteria or of ISO/IEC 27001: criteria and controls are named by number with our own words. It does not examine your controls, issue a SOC 2 report, decide whether NIS2 applies to you or report incidents for you. Every gap in the files reads TO COMPLETE.
Nothing you type leaves your browser; the files are built on your device. Templates, not legal advice.