NIS2 Documentation & Evidence Checklist
Lists the documents and records a supervisor is likely to request, with owner and status per item.
Available soon
- Format
- Excel
- Size
- 60 KB
- Length
- 10 sheets
- Version
- 1.9
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.9
Names the P27 documents.
- 1.8
Names the P26 documents.
- 1.7
Names the P25 documents.
Earlier versions (7)
- 1.6
Names the P24 documents.
- 1.5
Adds the P23 documents under measure (c), business continuity and backup management.
- 1.4
Names the P22 documents.
- 1.3
Counts the published security control assurance documents (P20) the measure library now lists.
- 1.2
Counts the published security maturity assessment documents (P19) the measure library now lists.
- 1.1
Counts the published access, privileged access and classification documents the measure library now lists against each measure.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Checklist. Each row is one document or record a supervisor may ask for, with the readiness item it proves and the CISO Times template that helps produce it. The items follow what NIS2 lets a competent authority request: documented cybersecurity policies, and evidence that they are implemented (Articles 32(2) and 33(2)). |
| 2 | Answer "Applies?" first. Answer No only where the item cannot apply to you, such as audit results when no security audit has been carried out or asked for, and give the reason in the Note. |
| 3 | For an item that applies, look at the record itself and answer the three questions from the drop-down lists: Exists? Complete and current? Can be produced in time? The Status column works out the result. Do not type over it. |
| 4 | Name one owner for each item: the person who keeps it current and would hand it over. Say what the record is and where it is kept, and the date you checked it. |
| 5 | For every item that is Partly ready or Not ready, enter its gap ID from the NIS2 Gap & Remediation Tracker (NR-09). The Check column tells you what is still missing on each row. |
| 6 | An item can be Ready while its measure still has an open gap: the record exists, the measure is not finished. The checklist asks whether a supervisor could be handed the record; the NIS2 Readiness Self-Assessment asks whether the measure works in full. EXAMPLE: EV-10 is Ready while GAP-05 stays open on RM-e; EV-12 is Ready while GAP-07 stays open on RM-g; EV-15 is Ready while GAP-06 stays open on RM-j. |
| 7 | Read the Results sheet: counts by area, and the level of readiness item SV-01 for the NIS2 Readiness Self-Assessment. Then complete the sign-off. |
| 8 | Repeat the check with each readiness self-assessment, at least every 6 months (NR-08). Add items of your own on the blank rows at the foot of the checklist, for example documents your national law asks for. |
| 9 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column. The items stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
NR-11: The documents and records on the evidence checklist must be kept current, so that any item can be produced within [[5]] working days of a supervisor's request.
Exists? Yes: the document or record exists. Partly: a draft, or only part of it exists. No: nothing exists yet.
Complete and current? Yes: it covers the whole item and is up to date (approved, within its review date, records kept to date). Partly: some of it is missing or out of date. No: it is badly out of date.
Can be produced in time? Yes: the owner knows where it is and could hand it over within 5 working days (NR-11). Partly: some of it would take longer. No: nobody could find it in time.
Status. Not applicable: "Applies?" is No. Not ready: the item does not exist. Ready: it exists, is complete and current, and can be produced in time. Partly ready: any other answer. Not assessed: a question is not answered yet.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, in wholesale distribution of food and catering supplies to businesses, which is important under NIS2 (scope assessment row ST-13). Its checklist as at 30 Sep 2026: 13 items ready, 3 partly ready, 1 not ready (no written cryptography policy) and 1 not applicable. Each item not fully ready is behind a gap in the tracker.
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
National law: [[national law transposing NIS2: title, number and date]]; competent authority: [[competent authority designated under that law]]. Add to the checklist [[any duty or field the national law adds to the Directive]] (NR-12).
Tailoring — small organisation: one short document can answer several items, such as a single security policy with its topic sections. Name it against each item it answers. What matters is that each record exists, is current and can be found.
Tailoring — group or regulated entity: where a parent company holds a record, such as the group security policy or a group audit, name it and say where your copy is. Where DORA applies instead of NIS2's risk-management and reporting duties, use your DORA register of documents instead.
Tailoring — IT run by a service provider: records the provider keeps count only if you can obtain them in time. Put that right in the contract, and name the provider's record and who asks for it.
Checklist
What a supervisor is likely to ask for, by area. Yellow columns are yours; Status and Check calculate. Any item must be ready to hand over within 5 working days (NR-11).
| Row | Item ID | Area | Readiness item it proves | Document or record a supervisor may ask for | CISO Times template that helps | Applies? | Exists? | Complete and current? | Can be produced in time? | Status | Owner | The record, and where it is kept | Date checked | Gap ID in the tracker | Note (reason for N/A, or what is missing) | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EV-01 | Scope and registration | SR-01 Scope and classification decided and recorded | Scope and classification assessment, approved | NIS2 Scope & Entity Classification Assessment (this pack) | Yes | Yes | Yes | Yes | Ready | Head of Information Security | Written assessment of 8 May 2026 (P10 action EA-02), confirmed by counsel and approved by the board on 21 May 2026; no trigger since. | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-02 | Scope and registration | SR-02 Registered with the competent authority, with details current | Registration submission, acknowledgement and change notices | NIS2 Competent Authority Registration Data Sheet (this pack) | Yes | Yes | Yes | Yes | Ready | Legal | Registered by Legal on 10 Apr 2025, acknowledged 24 Apr 2025; 3 changes since, each notified within two weeks (last on 26 Jun 2026). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-03 | Management body | GV-01 The management body approved the measures | Management body approval of the measures, minuted | Management Body Cybersecurity Accountability Record (this pack) | Yes | Yes | Yes | Yes | Ready | Board secretary | The board approved the measures on 30 Jul 2026 (minute [[B/2026/07-5]]), with measure (h) recorded as outstanding until its policy is approved (decision D-1). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-04 | Management body | GV-02 The management body oversees the measures | Management body oversight: reports received, questions, decisions | Management Body Cybersecurity Accountability Record (this pack) | Yes | Yes | Yes | Yes | Ready | Board secretary | The board receives the cyber report quarterly (P03); its questions and decisions are minuted. | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-05 | Management body | GV-03 Every member of the management body trained | Management body training records | Management Body Cybersecurity Training Plan (this pack) | Yes | Yes | Partly | Yes | Partly ready | Board secretary | 6 of 7 members trained at the 26 Feb 2026 session (P03 BM-08); the member appointed on 15 Jul 2026 is booked for 8 Oct 2026, inside the 3 months (due 15 Oct 2026). | 30 Sep 2026 | GAP-02 | Six of seven members trained; the seventh is booked | OK |
| EXAMPLE | EV-06 | Risk-management measures | RM-a Article 21(2)(a): risk analysis and security policies | Article 21(2)(a), risk analysis and security policies: an approved information security policy and topic policies, reviewed on a set cycle; a risk assessment method and a current risk register, with the treatment chosen for each risk and who accepted what remains | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (a): 9 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of Information Security | Risk register of 12 top risks reviewed at quarter end, with treatment and acceptance records (P05). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-07 | Risk-management measures | RM-b Article 21(2)(b): incident handling | Article 21(2)(b), incident handling: an incident management policy and a response plan, with roles and decision rights; a log of incidents with the reporting decision recorded for each, and reviews after serious ones | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (b): 11 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of Information Security | Incident policy and plan in use: 4 of 4 reports made on time in the quarter (P09 IMM-02). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-08 | Risk-management measures | RM-c Article 21(2)(c): business continuity and crisis management | Article 21(2)(c), business continuity and crisis management: backup arrangements for critical systems, with restore tests recorded; continuity and recovery plans for critical services, with recovery times; a crisis management arrangement that has been exercised | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (c): 20 published CISO Times documents listed there | Yes | Yes | Partly | Yes | Partly ready | Head of IT | 2 of 5 critical services restored in tests (P03 BM-06); rebuilding the ordering platform's recovery (P05 TA-01) is awaiting board approval. | 30 Sep 2026 | GAP-03 | Restore tests recorded for two of the five critical services | OK |
| EXAMPLE | EV-09 | Risk-management measures | RM-d Article 21(2)(d): supply chain security | Article 21(2)(d), supply chain security: a register of direct suppliers and service providers, tiered by how much the entity depends on them; assessments and contract clauses in proportion to each tier, taking account of each supplier's own weaknesses and practices (Article 21(3)) | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (d): 13 published CISO Times documents listed there | Yes | Yes | Partly | Yes | Partly ready | Information Security Manager | 9 of 14 critical suppliers assessed (P03 BM-05); the other 5 are booked by 8 Dec 2026 (P06). | 30 Sep 2026 | GAP-04 | Five Tier 1 suppliers not yet assessed | OK |
| EXAMPLE | EV-10 | Risk-management measures | RM-e Article 21(2)(e): security in acquisition, development and maintenance | Article 21(2)(e), security in acquisition, development and maintenance: security requirements applied when systems are bought, built or changed; vulnerabilities found, rated and fixed within set times, with the record; a way for outsiders to report a vulnerability, and how disclosure is handled | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (e): 12 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of IT | Critical exposure fixed on time: 81% against a target of 95% by deadline (Priority 1 in 7 days, Priority 2 in 14) (P03 BM-02); the action to bring it back (P05 TA-03) is at risk. | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-11 | Risk-management measures | RM-f Article 21(2)(f): assessing effectiveness | Article 21(2)(f), assessing effectiveness: measures of whether the security measures work, reported to management on a set cycle; reviews, audits or exercises, with what they found and what was done about it | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (f): 32 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of Information Security | Quarterly board measures (P03), an exercise programme with after-action reports (P10) and quarterly incident measures (P09). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-12 | Risk-management measures | RM-g Article 21(2)(g): cyber hygiene and training | Article 21(2)(g), cyber hygiene and training: basic rules for staff, such as updates, passwords, locking screens and safe use of email; security awareness training for staff, with completion records | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (g): 13 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | HR Learning Lead | Staff awareness training running with records, but short of its target: 92% of staff trained against a target of 95% (P03 BM-08). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-13 | Risk-management measures | RM-h Article 21(2)(h): cryptography and encryption | Article 21(2)(h), cryptography and encryption: a policy on when and how cryptography and encryption are used, and how keys are managed; where encryption is not used for data that would call for it, the recorded reason and who accepted it | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (h): no published CISO Times document yet | Yes | No | No | No | Not ready | Head of Information Security | Encryption is in use, and RA-01 records the six unencrypted laptops the firm accepted (P05). There is no written policy on the use of cryptography and on key management; the Head of Information Security owns writing one. | 30 Sep 2026 | GAP-01 | No written cryptography policy | OK |
| EXAMPLE | EV-14 | Risk-management measures | RM-i Article 21(2)(i): people, access and assets | Article 21(2)(i), people, access and assets: security steps when people join, move and leave; an access control policy and periodic access reviews, with what they removed; an inventory of the assets that matter | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (i): 33 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of IT | Access review UAR-2026-Q3 closed on 29 Sep 2026 (P07); supplier and asset registers kept (P06). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-15 | Risk-management measures | RM-j Article 21(2)(j): multi-factor authentication and secured communications | Article 21(2)(j), multi-factor authentication and secured communications: where multi-factor or continuous authentication is used, and where it is not with the reason; how voice, video and text communications inside the entity are secured; a secured way to communicate in an emergency when normal systems are down | NIS2 Article 21 Measure-to-Control Mapping Library (this pack), row (j): 2 published CISO Times documents listed there | Yes | Yes | Yes | Yes | Ready | Head of IT | Multi-factor authentication covers email and remote access, but by text message, which the attacker also phished in INC-2026-017 (P09). The out-of-hours route to the incident manager was fixed on 10 Sep 2026 and is drilled on 6 Oct 2026 (P09 PIA-05, P10). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-16 | Incident reporting | IR-01 Significant incidents screened and reported on time | Incident log, reporting screens and the reports made | P09-A09 Incident Case & Action Log (Security Incident Management pack) | Yes | Yes | Yes | Yes | Ready | Information Security Manager | INC-2026-014 was reported as significant: early warning 7 hours 15 minutes after awareness, and every report on time (P09). | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-17 | Supervision | SV-01 Evidence ready for a supervisor | Readiness self-assessment and gap tracker | NIS2 Readiness Self-Assessment (this pack) | Yes | Yes | Yes | Yes | Ready | Head of Information Security | Readiness self-assessment as at 2026-09-30, and the gap tracker with 7 gaps | 30 Sep 2026 | OK | ||
| EXAMPLE | EV-18 | Supervision | SV-01 Evidence ready for a supervisor | Results of any security audit, with the underlying evidence | None: the auditor's report and working papers | No | Not applicable | Head of Information Security | None held | 30 Sep 2026 | No security audit has been carried out or asked for | OK |
Results
Results and sign-off
The statuses by area and overall, the level of readiness item SV-01, and the sign-off. Everything above the sign-off is calculated.
EXAMPLE: the example organisation's checklist, as at 2026-09-30. Clear the EXAMPLE answers to use your own.
Status by area
| Area | Items | Ready | Partly ready | Not ready | Not applicable | Not assessed | No owner | Not ready, no gap in the tracker |
|---|---|---|---|---|---|---|---|---|
| Scope and registration | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Management body | 3 | 2 | 1 | 0 | 0 | 0 | 0 | 0 |
| Risk-management measures | 10 | 7 | 2 | 1 | 0 | 0 | 0 | 0 |
| Incident reporting | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Supervision | 2 | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
| All areas | 18 | 13 | 3 | 1 | 1 | 0 | 0 | 0 |
Items without an Item ID are not counted. An item in an area not on the list is counted in no area: use the Area list.
Result
| Measure | Result | How it is worked out | ||||||
|---|---|---|---|---|---|---|---|---|
| Items ready, of those that apply | 13 of 17 items ready | Ready items, out of all items less those Not applicable. | ||||||
| Readiness item SV-01, evidence ready for a supervisor | Operating | Operating: every item that applies has an owner and is Ready, or has a gap in the tracker. In place: an item has no owner, or is not ready with no gap. Not yet assessed: an item is not assessed. | ||||||
Copy the SV-01 level and its fact into the NIS2 Readiness Self-Assessment.
Sign-off
| Role | Name | Date | Signature or approval reference | |||||
|---|---|---|---|---|---|---|---|---|
| Checked by (NIS2 lead) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | |||||
| Accepted by (Executive sponsor) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | |||||
| Next check due | [[With the next readiness self-assessment, within 6 months (NR-08)]] | [[YYYY-MM-DD]] | ||||||
Supervisor Requests
What a supervisor may ask for
Why these items: what NIS2 lets a competent authority ask of an entity, as the Directive states it. The national law may add to it.
| Topic | What NIS2 or this pack says | What it means for this checklist |
|---|---|---|
| Essential entities | Article 32(2) — for essential entities, supervision includes on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | An entity that Article 3(1) of NIS2 classes as essential: mainly a large entity in an Annex I sector, and some entities whatever their size. Supervised both before and after an incident or complaint (Article 32). |
| Important entities | Article 33(2) — for important entities, supervision includes on-site inspections and off-site ex post supervision, targeted security audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | An entity of a type in Annex I or II that is in scope and is not essential (Article 3(2)). Supervised after the event, when the authority has evidence or an indication that it does not comply (Article 33). |
| What counts as evidence | The documents and records a competent authority may ask for: documented cybersecurity policies and evidence that they are implemented (Article 32(2) and Article 33(2)). | Every row on the Checklist is one such document or record. |
| How fast | NR-11: The documents and records on the evidence checklist must be kept current, so that any item can be produced within [[5]] working days of a supervisor's request. | Set the 5 working days to suit your authority's usual deadlines. |
| Your authority | [[competent authority designated under that law]], under [[national law transposing NIS2: title, number and date]] | [[any duty or field the national law adds to the Directive]]. Check the national text with counsel (NR-12). |
| EXAMPLE | In scope as an important entity. The same duties apply; supervision is after the event (Article 33). The maximum fine national law must allow is lower: at least €7 million or 1.4% of worldwide annual turnover, where it is at least €10 million or 2% for an essential entity (Article 34(4) and (5)). | The distributor is important (scope assessment row ST-13), so a request would follow a complaint, an incident or other indication. |
Lists
| Applies | Answer | Area |
|---|---|---|
| Yes | Yes | Scope and registration |
| No | Partly | Management body |
| No | Risk-management measures |
Incident reporting
Supervision
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Supervisory evidence | The documents and records a competent authority may ask for: documented cybersecurity policies and evidence that they are implemented (Article 32(2) and Article 33(2)). |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Essential entity | An entity that Article 3(1) of NIS2 classes as essential: mainly a large entity in an Annex I sector, and some entities whatever their size. Supervised both before and after an incident or complaint (Article 32). |
| Important entity | An entity of a type in Annex I or II that is in scope and is not essential (Article 3(2)). Supervised after the event, when the authority has evidence or an indication that it does not comply (Article 33). |
| Article 21 measures | The cybersecurity risk-management measures of Article 21: appropriate and proportionate to the risks, and including at least the ten in Article 21(2), points (a) to (j). |
| Readiness item | One of the requirements the NIS2 Readiness Self-Assessment rates, such as SR-01 (scope) or RM-a (the first measure). Each item on this checklist proves one of them. |
| Ready | The record exists, covers the whole item, is current, and the owner could hand it over in time. |
| Partly ready | The record exists, but part of it is missing or out of date, or some of it would take too long to produce. |
| Not ready | The record does not exist yet. |
| Not applicable | The item cannot apply to you. Give the reason. |
| Gap tracker | The NIS2 Gap & Remediation Tracker: every gap with one owner, a priority, a due date and the change that closes it (NR-09). |
| NR-nn | The pack's rules, NR-01 to NR-12, set out in the pack guide and quoted in each document. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Clear the EXAMPLE answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 7.5 — Documented information | The whole checklist: documented information kept, controlled and ready to produce |
| NIST CSF 2.0 | GV.PO-01 — “Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced” | EV-06 to EV-15: the policies behind each measure, and the records that show they are followed |
| NIS2 — Directive (EU) 2022/2555 | Article 32(2) — for essential entities, supervision includes on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | Supervisor Requests and every item: what an authority may ask of an essential entity |
| NIS2 — Directive (EU) 2022/2555 | Article 33(2) — for important entities, supervision includes on-site inspections and off-site ex post supervision, targeted security audits, security scans, and requests for information, including documented cybersecurity policies, for access to data and documents, and for evidence of implementation of cybersecurity policies | Supervisor Requests and every item: what an authority may ask of an important entity |
| NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | EV-03 and EV-04: the management body's approval and oversight of the measures |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | EV-06 to EV-15: the records for each of the ten measures |
| NIS2 — Directive (EU) 2022/2555 | Article 3(4) — entities submit at least their name; address and up-to-date contact details, including email addresses, IP ranges and telephone numbers; where applicable, the relevant sector and subsector in Annex I or II; and, where applicable, the Member States where they provide services in scope. They notify any change “without delay, and, in any event, within two weeks of the date of the change”. Member States may set up national mechanisms for entities to register themselves | EV-02: the registration information and change notices |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) | EV-16: the incident reports made |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.