NIS 2 template — Description of measures in place
The cybersecurity measures you confirmed in the analysis, with how they are carried out.
NIS2 · Luxembourg
Your NIS2 risk analysis, and the deliverables the ILR expects.
The ILR distinguishes two things: your own risk analysis, whose method you choose, and the supervision deliverables filled in its templates. Torus produces both, from the same work.
Measures in place What you confirmed in the analysis.
ILR
Cyber risk scenarios The ILR questionnaire, filled from your frozen, rated scenarios.
ILR
Multi-year action plan The measures selected, their owners, their deadlines.
ILR
List of dependencies Your direct suppliers and service providers as recorded by the analysis.
ILR
The file stays the official workbook: its sheets, instructions, scales and formulas are preserved. Only the input cells are filled.
What the ILR distinguishes
Two requirements, one body of analysis work.
The ILR states it itself: the analysis of the main cyber risk scenarios is a lighter supervision tool, limited to predefined scenarios. It does not exempt the entity from carrying out its own risk analysis. The Institute may ask for that detailed analysis, along with the elements demonstrating its implementation.
01
Your risk analysis
The one the NIS 2 law expects from the entity, with the method of your choice. Torus runs it by scenarios, with justified ratings and a treatment plan validated by your team.
02
The supervision deliverables
The templates published by the ILR, filled from the revision you validated — not from a parallel record kept on the side.
The four templates
Pre-filled from your analysis, ready for your review.
The file stays the official workbook: its sheets, instructions, scales and formulas are preserved. Only the input cells are filled.
NIS 2 template — Analysis of the main cyber risk scenarios
The ILR questionnaire, filled from your rated and frozen scenarios.
NIS 2 template — Multi-year action plan
The measures selected during treatment, with their owners and deadlines.
NIS 2 template — List of dependencies
Your direct suppliers and service providers, as the analysis recorded them.
Essential entities submit these deliverables annually; the list of dependencies may be requested by the ILR from certain categories of entities. Important entities fall under ex-post supervision and are exempt from regular submission, unless the Institute indicates otherwise. Deadlines and technical arrangements are set by ILR regulations: check your status and obligations with them.
How it runs
From your context to the workbook, with no double entry.
-
Frame
Sector, services and constraints. Missing information becomes optional questions, never a blocker.
-
Assess
Torus proposes scenarios fitted to your context; you keep, adjust or discard them.
-
Rate and treat
Current risk, residual risk with your confirmed controls, estimated target, then a treatment plan your team validates.
-
Freeze and produce
You freeze the revision. Torus derives the PDF reports, the Excel workbook and the four ILR templates from it.
What Torus does not do
The decision and the submission remain yours.
01
Torus does not determine whether you are an essential or an important entity.
02
Torus does not set your deadlines: those come from ILR regulations.
03
Torus sends nothing to the ILR. You review, you complete if needed, you submit.
04
The target ratings from your analysis are not injected into the Institute's templates.
05
Nothing the AI produces is kept without human validation.
Security & data
Your own instance, hosted in France.
Every client gets their own Torus Torus instance, operated by Torus at OVHcloud in France. Your documents and their index never leave it.
01
One dedicated instance per client: no data is shared with another client.
02
Documents, text extraction and the search index stay inside your instance.
03
To answer, only the question and the retrieved excerpts reach the AI model, under a ZDR (Zero Data Retention) contract.
04
Access is granted knowledge base by knowledge base, according to each user's role.
05
Answers cite their sources, and deliverables still require human validation.
Watch your NIS2 deliverables fill up.
A demo starts from your sector and your essential services: we run the analysis, then we open the templates.