What should an incident log contain for a NIS2 audit?
Enough to reconstruct each incident and each decision without asking anyone's memory. For every entry: a unique reference; when the incident started, when it was detected and by what, and when you became aware of it as significant or not; a short description and the systems, services and data affected; the severity assessment and who made it; whether it was reported, to whom and at what times, with copies of the reports; containment, eradication and recovery steps with times and owners; the root cause; and the lessons and changes that followed. Log near misses too, with the reason they were not reported. Keep the log tamper-resistant and access-controlled. NetSenX contributes the network side automatically: alerts with time, devices and destinations, NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. deadlines per incident and the audit log of who decided what.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we show an auditor what we decided on each security alert?
- How long must we keep security incident records?
- Can a network map be generated automatically from traffic for an auditor?
- Must we document data breaches that we decide not to report?
- When must we tell the affected people about a data breach?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
← All 35 questions on Incident reporting deadlinesAll topics