When you start preparing for NIS2, the first practical decision is what you work with: the official DNSC Excel templates or a dedicated platform. There is no universally correct answer. The choice depends on the size and complexity of your organisation. In this article we make a balanced comparison, so that you decide with full knowledge.
The starting point: evidence and registers
Regardless of the tool, NIS2 compliance rests on the same thing: evidence and registers correlated with the CyFun controls. You must be able to show that a measure exists, that it works and that you have proof of it. We wrote at length about this foundation in NIS2 evidence and registers.
That is why the question is not which tool gives you compliance, but which one helps you keep the self-assessment, the plan, the registers and the evidence correct and up to date. Both options start from the same CyFun framework and the same controls; what differs is the maintenance effort, the risk of errors and the ease of collaboration.
It is worth saying clearly from the start: there is no legal obligation to use a particular platform. The requirement is to be able to demonstrate compliance, not to demonstrate it with a particular type of software. DNSC provides official templates, and an organisation can use them in full. The choice between Excel and a platform is therefore a decision of efficiency and operational risk, not one of compliance in itself.
An honest comparison: Excel vs platform
| Criterion | DNSC Excel templates | Dedicated platform |
|---|---|---|
| Effort | Small at the start, grows with complexity | Initial setup, then steady effort at scale |
| Risk of errors | Higher: manual copying, uncorrelated versions | Lower: automatic links between data |
| Updating on changes | Manual, file by file | Central, propagated across the whole system |
| Collaboration | Difficult with several people | Multiple users, roles, history |
| Evidence and registers | Linked manually to controls | Linked directly to controls and to the plan |
| Reporting | Built manually | Generated from data |
| Cost | Free | Free starting steps at Certudo |
The table does not declare an absolute winner. It only says where each factor is felt. For a small organisation, the small initial effort of Excel can matter more than the scale advantages of a platform. For a complex one, the risk of errors and the difficulty of collaboration in Excel can become more costly than the initial setup of a platform.
When Excel is enough
The official DNSC templates are free and, for many small organisations, perfectly sufficient. Excel works well when:
- You have few systems, a single location and few relevant suppliers.
- The number of controls to cover is manageable manually.
- Few people work on the documentation, so coordination is simple.
- The context is stable, with few changes to track.
In these cases, a platform can be a plus in comfort, but not a necessity. What matters is that the self-assessment, the plan, the registers and the evidence are correct and up to date, not the medium they are kept on.
When the platform makes the difference
As complexity grows, Excel becomes hard to maintain and risky. A dedicated platform helps especially with:
- Scale. More systems, locations and suppliers mean more controls and more evidence; a platform keeps them linked, not scattered across dozens of files.
- Continuity. Requirements and context change over time. A platform propagates updates centrally, so that part of the documentation does not fall behind.
- Collaboration. With roles, history and simultaneous access, several people can work without overwriting each other.
- The evidence, control, plan link. When each piece of evidence is linked directly to the control and the plan step it corresponds to, the audit becomes much easier.
- Reporting. Reports are generated from data, not built manually every time.
The Certudo platform offers the starting steps for free: classification, the risk analysis, the CyFun maturity self-assessment and the implementation plan. In this way you can test the advantages at no cost, before deciding whether you need consultancy or advanced features.
Where most problems with Excel arise
Excel does not go wrong on its own; the problems arise from the way we use it at scale. In practice, the most frequent difficulties are:
- Uncorrelated versions. When several people work on different copies of the same file, you quickly end up with versions that no longer match, and the audit discovers contradictions between documents.
- Evidence detached from controls. In a file, the link between a control and the evidence that supports it exists only in the mind of the person who filled it in. If that person leaves, the link is lost.
- Incomplete updates. When a requirement changes, all the affected files must be modified manually. It is easy to forget one, and that file falls behind without anyone noticing.
- Lack of history. Excel does not easily tell you who modified what and when. For an audit, the traceability of changes is an important plus.
None of these problems is fatal for a small and disciplined organisation. But they all amplify as the number of people, systems and changes grows.
What a platform adds
The advantage of a platform is not that it gives you compliance, but that it reduces the effort and the risk of keeping it correct. Concretely, a dedicated platform:
- keeps the self-assessment, the plan, the registers and the evidence linked together, so that a change is reflected everywhere;
- ensures full traceability of all operations, by automatically recording the user, the action and the time of execution;
- allows several people to work simultaneously, with roles and controlled access;
- generates reports from data, instead of you building them manually every time;
- propagates updates centrally when the requirements change, reducing the risk that part of the documentation falls behind.
In the Certudo platform, these starting steps are free, which means you can experience the advantages without committing to a cost before knowing whether you need them.
How to decide in practice
Choose according to your reality, not fashion:
- Are you small, stable, with few people and systems? Start with the official DNSC Excel; it is free and enough.
- Do you have complexity, collaboration and a need for continuity? A platform will save you time and reduce your risk of errors in the long run.
- Not sure? Start for free with the steps in the Certudo platform. If you discover that Excel would have been enough for you, you have lost nothing; the substantive work remains valid anyway.
A good practical criterion is to look at the time horizon. NIS2 compliance is not a project that ends at the audit, but a continuous process: incidents are reported, risks are reviewed, measures are updated. If you look only at the first audit, Excel can seem enough. If you look at maintenance over several years, with changes of team and context, the continuity advantages of a platform weigh more. Choose the right tool not just for the current moment, but for the way you will maintain compliance over time.
You can see how everything looks in one place on the NIS2 platform page, and if you want to start right now, use the classification and registration tool.
Start the classification for free
Do you need help choosing between Excel and a platform for your concrete situation? Write to us and we will give you an honest recommendation, depending on the size and complexity of your organisation.
Frequently asked questions
Can I do NIS2 compliance with just the DNSC Excel templates?
Yes. The official DNSC templates are free and can be enough for a small organisation, with few systems and few people involved. The important thing is that the self-assessment, the plan, the registers and the evidence are correct and up to date, regardless of the tool used.
When is a dedicated platform worth it instead of Excel?
The platform becomes useful at scale: when you have several systems, locations or suppliers, more people collaborating, a need for continuity over time and for a clear link between controls, registers and evidence. As complexity grows, Excel becomes hard to maintain.
Does the Certudo platform cost money?
The starting steps (classification, the risk analysis, the CyFun maturity self-assessment and the implementation plan) are free in the Certudo platform, and the self-assessment consultancy is optional. Separately, implementing the controls (security tools, effort, possibly implementation consultancy) and the external audit have their own costs.
Do the official DNSC Excel and the platform give different results?
Not at the level of requirements: both start from the same CyFun framework and the same controls. What differs is the effort to keep them correct, the risk of errors, the ease of collaboration and the way you link evidence to controls.
What happens to the Excel when the requirements change?
With Excel, you update the files manually and risk uncorrelated versions. A platform can propagate the changes centrally, which reduces the risk that part of the documentation falls behind.
Do I lose anything if I start with Excel and then switch to a platform?
Not necessarily. The substantive work, that is understanding the controls and the evidence, remains valid. The switch to a platform mainly means reorganising the information in a place that is easier to maintain and collaborate on.