What evidence will a NIS2 supervisor ask for?

Evidence that the measures exist, are approved by management and actually work. Expect requests for: the scope assessment and registration; the risk analysis and the security policies covering the Article 21(2) areas; minutes showing the management body approved and reviewed them, and records of management training; the incident-handling procedure and the register of incidents, with the reports you submitted and their timing; backup and restore-test results; the supplier list with contracts and assessments; access-control and multi-factor-authentication status; and results of audits, penetration tests and the fixes that followed. German law, for example, requires entities to document compliance with their risk-management duties (section 30(1) BSIG). NetSenX contributes incident evidence: alerts with time, devices and destinations, NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. deadlines per incident, an audit log of decisions and, from the Starter plan, PDF reports.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics