How do we get ready for a NIS2 supervisor's request for evidence?

Start

A NIS2 supervisor may ask us for evidence

NIS2 lets a competent authority inspect, audit, scan and request information, including your documented cybersecurity policies, access to data and documents, and evidence that the policies are implemented. So be ready with both: the policies, and the records that show them working. National law may add to what the authority can ask for.

• Then: Is your scope and classification decided in writing?

Decision

Is your scope and classification decided in writing?

Everything that follows depends on whether you are essential or important, and the scope assessment is itself the first record a supervisor asks for. It counts when it gives each answer with its source and reasoning, was confirmed with counsel, approved by the management body, and reviewed within the last 12 months or since the last trigger.

• Yes: Does DORA apply instead of some NIS2 duties?
• No, or not known: Settle scope and classification first

Outcome

Settle scope and classification first

Run the scope assessment, have counsel confirm it, and take it to the management body before you build the evidence set. Without it you cannot say how a supervisor would approach you, and the first item on the checklist is missing.

Decision

Does DORA apply instead of some NIS2 duties?

For a financial entity, the pack says DORA applies instead of NIS2's risk-management and reporting duties, and to confirm that with counsel. If you are not sure, keep every NIS2 item on the list until counsel confirms which ones give way.

• Yes: a financial entity: Use your DORA register for the items DORA covers
• No, or not known: Are you an essential or an important entity?

Step

Use your DORA register for the items DORA covers

Where DORA applies instead of NIS2's risk-management and reporting duties, the pack says to use your DORA register of documents for them. With counsel, mark those NIS2 items not applicable, with that reason, and assess them against DORA. Keep the rest of the list.

• Then: Are you an essential or an important entity?

Decision

Are you an essential or an important entity?

The same documents answer both. What differs is when a supervisor is likely to ask. An essential entity is supervised before and after the event: on-site inspections, regular, targeted and ad hoc audits, scans and requests for information. An important entity is supervised after the event, when the authority has evidence or an indication that it does not comply.

• Essential: Be ready at any time, not only after an incident
• Important: Expect the request after a complaint, incident or indication

Step

Be ready at any time, not only after an incident

A request can come without warning, so the evidence set has to be current all year, not assembled when a letter arrives. The pack also tells an essential entity to treat gaps where a measure is in place but not yet operating as urgent, because a supervisor would find them as soon as it asks.

• Then: List the records a supervisor may ask for

Step

Expect the request after a complaint, incident or indication

Supervision of an important entity follows evidence or an indication that it does not comply, such as a complaint or an incident. A request could come while you are still handling that incident, so prepare the set in advance in the same way.

• Then: List the records a supervisor may ask for

Step

List the records a supervisor may ask for

The pack's checklist has 18 items in five areas: scope and registration; the management body's approval, oversight and training; one item for each of the ten risk-management measures; incident reporting; and supervision, such as your self-assessment and the results of any security audit. Add anything your national law asks for. A small organisation may answer several items with one document; name it against each. A group may rely on a parent's record if it says where its copy is.

• Then: For each measure, name what you could show

Step

For each measure, name what you could show

For each of the ten measures, name the policies, procedures and records that put it in place for you, and one owner. The test is what you could hand over today. The pack does not say that any ISO/IEC 27001 control or NIST CSF outcome meets a NIS2 measure, and using a template does not by itself show that a measure is met. Size each measure to the risks your risk assessment shows.

• Then: Can this item apply to you?

Decision

Can this item apply to you?

Take each item in turn. Answer no only where it cannot apply, for example audit results when no security audit has been carried out or asked for, and write down the reason. When you are unsure, treat the item as applying.

• No: it cannot apply: Mark it not applicable, with the reason
• Yes, or not sure: Does the record itself exist?

Step

Mark it not applicable, with the reason

The reason is part of the evidence: a supervisor who sees an item marked not applicable will ask why. Check it again at the next review, because it can start to apply, for example once an audit is ordered.

• Then: Sign off, and repeat with each self-assessment

Decision

Does the record itself exist?

Open the record and look; do not rely on what people say. A draft, or only part of the record, is a partial answer. Nothing at all makes the item not ready.

• Yes: Is it complete and current?
• Partly, no, or not known: Not fully ready: raise a gap in your tracker

Decision

Is it complete and current?

Complete and current means it covers the whole item and is up to date: approved, within its review date, with records kept to date. Anything missing or out of date makes it partly ready.

• Yes: Could its owner hand it over within 5 working days?
• Partly, no, or not known: Not fully ready: raise a gap in your tracker

Decision

Could its owner hand it over within 5 working days?

The 5 working days is the pack's default, to set to suit your authority's usual deadlines. The owner must know where the record is. Where a service provider holds it, it counts only if you can obtain it in time, so put that right in the contract.

• Yes: Ready: keep it current, with one named owner
• Partly, no, or not known: Not fully ready: raise a gap in your tracker

Step

Ready: keep it current, with one named owner

Name one owner who keeps the record current and would hand it over, and say where it is kept. A record can be ready while its measure still has an open gap: the checklist asks whether a supervisor could be handed the record, and the self-assessment asks whether the measure works in full.

• Then: Sign off, and repeat with each self-assessment

Step

Not fully ready: raise a gap in your tracker

Every item partly ready or not ready goes into your gap tracker with one owner, a priority, a due date and the change that closes it, and is corrected without undue delay. Put the gap's ID against the item, so the evidence set shows the gap is known and owned.

• Then: Sign off, and repeat with each self-assessment

Outcome

Sign off, and repeat with each self-assessment

The evidence set is in order when every item that applies has an owner and is ready, or has its gap in the tracker. The NIS2 lead checks it and an executive sponsor accepts it. Repeat the check with each readiness self-assessment, at least every 6 months by the pack's default, and after a significant incident or a change in scope.