# What evidence will a NIS2 supervisor ask for?

Evidence that the measures exist, are approved by management and actually work. Expect requests for: the scope assessment and registration; the risk analysis and the security policies covering the Article 21(2) areas; minutes showing the management body approved and reviewed them, and records of management training; the incident-handling procedure and the register of incidents, with the reports you submitted and their timing; backup and restore-test results; the supplier list with contracts and assessments; access-control and multi-factor-authentication status; and results of audits, penetration tests and the fixes that followed. German law, for example, requires entities to document compliance with their risk-management duties (section 30(1) BSIG). NetSenX contributes incident evidence: alerts with time, devices and destinations, NIS2 deadlines per incident, an audit log of decisions and, from the Starter plan, PDF reports.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/what-evidence-will-a-nis2-supervisor-ask-for

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is Implementing Regulation (EU) 2024/2690 under NIS2?](https://netsenx.com/en/faq/what-is-the-nis2-implementing-regulation-2024-2690)
- [How do national NIS2 laws differ between EU countries?](https://netsenx.com/en/faq/how-do-national-nis2-laws-differ)
- [Do I need NDR for NIS2?](https://netsenx.com/en/faq/do-i-need-ndr-for-nis2)
- [Does NIS2 require network monitoring?](https://netsenx.com/en/faq/does-nis2-require-network-monitoring)
- [What are the NIS2 incident reporting deadlines?](https://netsenx.com/en/faq/what-are-the-nis2-incident-reporting-deadlines)