NIS2: what technical evidence should you prepare for a cybersecurity review?

A signed security policy does not by itself prove that controls are operating. A more useful question for an organisation preparing for a NIS2 review is: what dated, scoped record would allow an independent reviewer to verify a control? 1

Identify which requirements actually apply

Article 21 of NIS2 requires appropriate and proportionate technical, operational and organisational measures covering risk management, incidents, business continuity, supply-chain security, access and assets. National transposition and supervisory arrangements must be checked for the organisation concerned. 1

Commission Implementing Regulation (EU) 2024/2690 provides more specific requirements for defined categories of digital infrastructure and service providers, including cloud, data centres, managed services and certain other digital actors. It does not impose an identical technical checklist on every NIS2 sector. ENISA's implementation guidance supports that regulation and includes examples of evidence; it should not be represented as a universal list of mandatory records. 2 3

Ten useful categories of evidence

| Area | Example of evidence | Question to ask | | --- | --- | --- | | 1. Governance | Approved policy, assigned owners, review minutes | Who is accountable? | | 2. Risk management | Dated risk register and treatment decisions | What residual risk was accepted? | | 3. Assets | Application, infrastructure and cloud inventories | Is the scope current? | | 4. Access | Privileged-access reviews and MFA exceptions | Were findings resolved? | | 5. Vulnerabilities | Scan results, remediation tickets and exceptions | Can closure be demonstrated? | | 6. Incidents | Response playbook and exercise records | Does escalation work? | | 7. Continuity | Backup restore and recovery-test results | Did the business service recover? | | 8. Suppliers | Supplier register, criticality and follow-up | Which service depends on whom? | | 9. Awareness | Training programme and participation records | Was training delivered? | | 10. Effectiveness | Metrics, assessments and corrective actions | Are measures actually evaluated? |

This table is a practical preparation framework, not a universal statutory checklist or a guarantee of compliance.

Make every record auditable

An MFA screenshot without a date, scope or list of exclusions can be misleading. For each record, capture the control or risk addressed, accountable owner, system scope, collection date, method, observed result, exceptions and remediation status. Remove unnecessary personal data and secrets before sharing an evidence package.

Asset inventories connect controls to the systems they protect. A maintained information-system map can link applications to owners, processes, infrastructure and suppliers, but it does not replace actual control testing. 4

Fictional example: a managed IT provider

A provider assembles its risk policy, internal asset register, privileged-access review and two recovery exercise reports. The review reveals that database restoration was tested, but the identity service needed by recovery operators was not. The gap is assigned to an owner, scheduled for correction and retested.

This creates a stronger evidence trail than a collection of uncontextualised screenshots: finding, decision, action and verification.

Five checks before the review

• Have requirements been scoped to the relevant country and sector?
• Is every record linked to an owner, system and reporting period?
• Are exceptions and compensating measures documented?
• Do tests demonstrate outcomes, not just the existence of procedures?
• Can sensitive records be transferred and retained securely?

Effective NIS2 preparation means maintaining evidence as operations evolve, rather than assembling a static folder immediately before an assessment.