# What should an incident log contain for a NIS2 audit?

Enough to reconstruct each incident and each decision without asking anyone's memory. For every entry: a unique reference; when the incident started, when it was detected and by what, and when you became aware of it as significant or not; a short description and the systems, services and data affected; the severity assessment and who made it; whether it was reported, to whom and at what times, with copies of the reports; containment, eradication and recovery steps with times and owners; the root cause; and the lessons and changes that followed. Log near misses too, with the reason they were not reported. Keep the log tamper-resistant and access-controlled. NetSenX contributes the network side automatically: alerts with time, devices and destinations, NIS2 deadlines per incident and the audit log of who decided what.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/what-should-an-incident-log-contain-for-a-nis2-audit

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [How do we show an auditor what we decided on each security alert?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-what-we-decided-on-each-alert)
- [How long must we keep security incident records?](https://netsenx.com/en/faq/how-long-must-we-keep-security-incident-records)
- [Can a network map be generated automatically from traffic for an auditor?](https://netsenx.com/en/faq/can-a-network-map-be-generated-automatically-for-an-auditor)
- [Must we document data breaches that we decide not to report?](https://netsenx.com/en/faq/must-we-document-data-breaches-we-do-not-report)
- [When must we tell the affected people about a data breach?](https://netsenx.com/en/faq/when-must-we-tell-affected-people-about-a-data-breach)