Control Assurance Dashboard
Reports tested coverage, pass rates, open deficiencies and assurance readiness per framework.
Available soon
- Format
- Excel
- Size
- 111 KB
- Length
- 13 sheets
- Version
- 1.2
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.2
The restore-testing note names P23's Restore Testing Methodology.
- 1.1
The restore-testing note names P22's RR-14.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this dashboard is. The quarterly report of the control testing programme, kept by the control assurance lead and read by the assurance sponsor. It holds a copy of the key fields of the Control Inventory & Ownership Register, the workpapers (Control Test Workpaper Template), the Control Deficiency & Remediation Tracker and the Annual Control Testing Plan, and works out every measure from them. |
| 2 | On the Summary sheet, enter the As-at date (the quarter's last day) and the date the plan year starts. Type both; never a formula that changes them. Every overdue flag and every measure is worked out at the As-at date. |
| 3 | On the Controls sheet, copy each control from the Control Inventory & Ownership Register: its ID, name, source rule and document, owner, whether it is key, and its risk rating as at the As-at date. The test cycle, last result, next test due, overdue flag and next planned test calculate. |
| 4 | On the Tests sheet, add one row per workpaper: the control, its risk rating when tested, the dates, the design conclusion, the population, the exceptions, the tester and the reviewer, and the date the reviewer signed. The sample size (CA-05) and the conclusion (CA-07) calculate. If either differs from the workpaper, find out why before you report. |
| 5 | On the Deficiencies sheet, copy each deficiency from the Control Deficiency & Remediation Tracker. Severity (CA-12), the date the plan must be agreed by and the due date (CA-13) calculate from the date the reviewer confirmed it. Below it, list each exception recorded on a test concluded Effective. |
| 6 | On the Plan Progress sheet, copy each test the Annual Control Testing Plan sets, with its month. When the workpaper is signed, enter the date. The sheet shows what is due by the As-at date and what was final in time: signed by the reviewer within the review days after the end of its month (CA-11). |
| 7 | Read the By NIS2 Point sheet. It counts, for each point of NIS2 Article 21(2), the controls whose source document cites that point, and how many of them are tested and effective. It does not say any point is met. Fill its second block from the Unified Control Framework Mapping Workbook if you report by the requirements you rely on your controls for. |
| 8 | On the Summary sheet, read the six headline measures and write the commentary: what changed since last quarter and what you ask the sponsor to decide. Keep each quarter's copy of the workbook, with the workpapers it reports, as the record. |
| 9 | To start your own dashboard, delete the contents of the first column and of every yellow cell on the Controls, Tests, Deficiencies and Plan Progress sheets, and the exceptions noted. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you test whether your security controls work. It is not legal advice, and a test result is not a statement that you comply with NIS2, DORA, the GDPR or any standard. Where a law, a certification or a contract asks for an audit or an independent review, confirm with counsel, your certification body or the other party what it must include.
What this dashboard is not (CA-18, CA-19) is set out at the foot of the Summary sheet. It does not say which control meets which requirement: that is your own record in the Unified Control Framework Mapping Workbook (CA-17).
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State. Its Quality and Compliance Manager, who owns and performs no control, leads the programme from 1 Sep 2026. The pilot round TR-2026-P, 21 Sep 2026 to 25 Sep 2026, tested seven controls over 1 Mar 2026 to 31 Aug 2026; the Internal Audit Manager reviewed the workpapers on 28 Sep 2026. The Chief Operating Officer approved the first annual plan on 30 Sep 2026. The dashboard is as at 30 Sep 2026.
Tailoring — small organisation: the six measures are the minimum. Where one person leads and tests, a colleague from another function or internal audit reviews their workpapers (CA-10, CA-11).
Tailoring — financial entity under DORA: test results can feed the yearly review of the ICT risk management framework and the internal audit. The dashboard is neither of them.
This workbook is your own record. Keep it with the workpapers it reports.
Summary
Control assurance: quarterly dashboard
For the assurance sponsor, each quarter. Yellow cells are yours; everything else calculates from the Controls, Tests, Deficiencies and Plan Progress sheets. Every figure is a count, and every status is in words; the colour only repeats it.
Report settings
| Setting | Value | Note |
|---|---|---|
| As-at date (the quarter's last day) | 30 Sep 2026 | Every flag and measure is worked out at this date. |
| Plan year starts | 1 Oct 2026 | The first day of the Annual Control Testing Plan's year. |
| Quarter reported | Q3 2026 | Your words. |
| Plan approved by the sponsor on | 30 Sep 2026 | Before the plan year starts (CA-16). |
Headline measures (CA-19: counts, never a share)
| Measure | Result at the As-at date | Target | Named | What it means | The decision it supports | Lead's commentary |
|---|---|---|---|---|---|---|
| CAM-01 Controls tested within their cycle | 5 of 30 | All, by the end of each control's first cycle | See the Controls sheet | How many controls have a test recent enough to rely on. A control outside its cycle may still work: there is simply no current evidence that it does. | Whether testing keeps pace with the plan, and which controls to test next. | [[What changed since last quarter, and what you ask the sponsor to decide]] |
| CAM-02 Tested controls effective | 4 of 5 | All | 1 not effective: see CAM-04 | Of the controls tested within their cycle, how many worked throughout their testing period. An exception recorded on an Effective test is named on the Deficiencies sheet. | Which failed controls need a fix and a retest, and which results an audit or a customer review can be shown. | [[What changed since last quarter, and what you ask the sponsor to decide]] |
| CAM-03 Key controls never tested | 19 of 24 | None after the first plan year | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25, CT-27, CT-28, CT-29, CT-30 | Key controls with no operating test concluded. Until each is tested, nobody knows whether it works. | Whether the plan reaches them in time, and whether to bring a test forward where an audit or review relies on the control (CA-16). | [[What changed since last quarter, and what you ask the sponsor to decide]] |
| CAM-04 Open deficiencies by severity | High 2, Medium 0, Low 0 | No High open past its due date | DF-01 (CT-13, High); DF-02 (CT-02, High) | Deficiencies not yet closed by a passed retest. High means a key control failed with no compensating control tested effective, or a risk outside appetite is left without its control. | Whether each open deficiency has an owner, an agreed plan and the resources to meet its due date. | [[What changed since last quarter, and what you ask the sponsor to decide]] |
| CAM-05 Deficiencies past their due date | None | None | None | Open deficiencies whose due date has passed with no approved deferral. | For each one: escalate, fund the fix, or defer it as a P02 exception with the remaining risk accepted (CA-13). The assurance sponsor decides on any High one. | [[What changed since last quarter, and what you ask the sponsor to decide]] |
| CAM-06 Planned tests delivered | The plan starts on 1 Oct 2026 | All; any slip recorded with its new date | None late | Tests whose workpaper the reviewer signed by the end of the planned month plus the review days (CA-11), out of the tests the plan set for the year to date. | Whether testing capacity is enough, and whether to approve a change to the plan, which is then recorded (CA-16). | [[What changed since last quarter, and what you ask the sponsor to decide]] |
Each figure is a count of named controls, tests or deficiencies. Add none of them together, and never show one as a percentage (CA-19).
Behind the headline
| Count | At the As-at date | Where to look |
|---|---|---|
| Controls in the inventory | 30 | Controls |
| of which key controls | 24 | Controls |
| Controls with a concluded operating test | 5 | Controls |
| of which Not effective at their last test | 1 | Controls; Deficiencies |
| Latest test found the design deficient | 1 | Tests; Deficiencies |
| Latest test: Not tested, as the control had not yet run | 1 | Tests |
| Workpapers awaiting the reviewer's signature | 0 | Tests |
| Exceptions recorded on tests concluded Effective | 1 | Deficiencies, foot of the sheet |
| Controls overdue for an operating test | 0 | Controls |
| Next due date of an open deficiency | 27 Dec 2026 | Deficiencies |
The year's plan by quarter (CAM-06)
| Plan quarter | From | To | Tests planned | Due by the As-at date | Final in time |
|---|---|---|---|---|---|
| Q1 | 1 Oct 2026 | 1 Dec 2026 | 8 | 0 | 0 |
| Q2 | 1 Jan 2027 | 1 Mar 2027 | 10 | 0 | 0 |
| Q3 | 1 Apr 2027 | 1 Jun 2027 | 9 | 0 | 0 |
| Q4 | 1 Jul 2027 | 1 Sep 2027 | 6 | 0 | 0 |
| The year | 33 | 0 | 0 |
Design checks count as planned tests. A Lower-risk control whose operating test waits for the second year of its cycle still has its design checked this year (CA-02); the Controls sheet shows its operation as "Next plan year (Lower: 24-month cycle)".
What this dashboard is not
Control testing is not an internal audit, a certification audit, a P19 maturity assessment or a statement of compliance, and is never presented as one. Its results can feed each of them. (CA-18)
Results are reported as counts, such as "21 of 30 controls tested", with every deficiency named. There is no overall assurance score, no weighting, and no figure presented as a share of compliance with any framework. (CA-19)
It does not say which control meets which requirement. The By NIS2 Point sheet counts the controls whose source documents cite each point of NIS2 Article 21(2); that is the documents' own citation, not a statement that the point is met.
A control tested Effective worked on the occurrences sampled, over its testing period. It says nothing about periods not tested, or about risks no control in the inventory addresses.
Settings the formulas read (from the methodology)
| Risk rating (CA-15) | Test cycle, months | When it applies | |||
|---|---|---|---|---|---|
| Higher | 6 | A key control on which a risk outside appetite, or an obligation the organisation has recorded as not met, rests; or a control that failed its last test. | |||
| Standard | 12 | Any other key control. | |||
| Lower | 24 | A control that is not key. Its design is still checked every 12 months (CA-02). | |||
| Population from (CA-05) | Population to | Sample, Standard or Lower | Sample, Higher | Typical control |
|---|---|---|---|---|
| 1 | 2 | All | All | An annual control, or a quarterly one tested over six months |
| 3 | 12 | 2 | 3 | A quarterly or monthly control |
| 13 | 52 | 5 | 10 | A weekly control, or events a few times a month |
| 53 | 250 | 20 | 30 | A daily control, or events most working days |
| 251 | and above | 25 | 40 | A control that runs many times a day |
| Severity (CA-12) | Days to fix (CA-13) |
|---|---|
| High | 90 |
| Medium | 180 |
| Low | 365 |
| Working days to agree a remediation plan (CA-13) | 10 |
| Working days after the last test step for the reviewer to sign (CA-11) | 10 |
These are the Control Testing Methodology's values. Where you change one there, change it here; public holidays are yours to add to the working-day count.
Controls
One row per control, from the Control Inventory & Ownership Register. Yellow columns are yours; white columns calculate at the As-at date on the Summary sheet.
| Row | Control ID | Control | Source rule | Source document | NIS2 Article 21(2) points its source document cites | Control owner | Key control | Risk rating | Control started on, if after the plan year began | Test cycle, months (calc) | Latest test result (calc) | Last concluded operating test: period end (calc) | Its conclusion (calc) | Tested within its cycle (calc) | Next operating test due (calc) | Due date counted from (calc) | Overdue at the As-at date (calc) | Next planned operating test (calc) | Next planned design check (calc) | Key control never tested (calc) | Key controls never tested, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CT-01 | Board report from checked figures | P03 BR-08 | P03-A05 | None | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Dec 2026 | With its operating test (CA-02) | Yes | CT-01 | |||
| EXAMPLE | CT-02 | Policy reviews on time | P04 PF-06 | P04-A02 | (a) | Head of Information Security | Yes | Higher | 6 | Design deficient | No | After the design is fixed (CA-01) | Not due | 1 Jul 2027 | 1 Jan 2027 | Yes | CT-01, CT-02 | ||||
| EXAMPLE | CT-03 | Joiners acknowledge policies | P04 PF-09 | P04-A02 | (a) | HR Director | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Oct 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03 | |||
| EXAMPLE | CT-04 | Quarterly risk review | P05 RM-09 | P05-A02 | (a) | Head of Information Security | Yes | Standard | 12 | Effective | 31 Aug 2026 | Effective | Yes | 31 Aug 2027 | End of the last tested period | Not due | 1 Jul 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03 | |
| EXAMPLE | CT-05 | Exceptions approved and renewed in time | P02 EX-05, EX-06, EX-10 | P02-A02 | (a), (i) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Oct 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05 | |||
| EXAMPLE | CT-06 | Monthly exception register review | P02 EX-11 | P02-A02 | (a), (i) | Head of Information Security | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Dec 2026 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05 | |||
| EXAMPLE | CT-07 | Tier 1 suppliers reassessed in time | P06 TP-09 | P06-A02 | (d) | Information Security Manager | Yes | Higher | 6 | Never tested | No | 1 Apr 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Nov 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07 | |||
| EXAMPLE | CT-08 | Metric inputs checked before reporting | P11 MR-05, MR-06 | P11-A02 | (f) | Head of Information Security | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Feb 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07 | |||
| EXAMPLE | CT-09 | NIS2 readiness self-assessed | P12 NR-08 | P12-A04 | None | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Feb 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09 | |||
| EXAMPLE | CT-10 | Board members trained | P12 NR-05 | P12-A06 | None | Board secretary | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 May 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10 | |||
| EXAMPLE | CT-11 | Information register reviewed | P15 CL-03, CL-12 | P15-A02 | (i) | Head of Information Security | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jun 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10 | |||
| EXAMPLE | CT-12 | Disposal certificates collected | P15 CL-11 | P15-A02 | (i) | Head of IT | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | Next plan year (Lower: 24-month cycle) | 1 Apr 2027 | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10 | |||
| EXAMPLE | CT-13 | Urgent vulnerabilities fixed in time | P01 VM-08 | P01-A02 | (e) | Head of IT | Yes | Higher | 6 | Not effective | 31 Aug 2026 | Not effective | Yes | 28 Feb 2027 | End of the last tested period | Not due | 1 Feb 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10 | |
| EXAMPLE | CT-14 | Vendor releases reviewed | P17 PM-03 | P17-A02 | (e) | Head of IT | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | Next plan year (Lower: 24-month cycle) | 1 Aug 2027 | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10 | |||
| EXAMPLE | CT-15 | Missed patch deadlines deferred | P17 PM-14 | P17-A02 | (e) | Head of IT | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jan 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15 | |||
| EXAMPLE | CT-16 | Leavers' access removed | P13 JML-09 | P13-A02 | (i) | Head of IT | Yes | Standard | 12 | Effective | 31 Aug 2026 | Effective | Yes | 31 Aug 2027 | End of the last tested period | Not due | 1 Mar 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15 | |
| EXAMPLE | CT-17 | Movers' old access removed | P13 JML-08 | P13-A02 | (i) | Head of IT | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Nov 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17 | |||
| EXAMPLE | CT-18 | Monthly account reconciliation | P13 JML-15 | P13-A02 | (i) | Head of IT | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Dec 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18 | |||
| EXAMPLE | CT-19 | User access reviews | P07 AR-02, AR-07 | P07-A02 | (i) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Mar 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19 | |||
| EXAMPLE | CT-20 | Privileged access reviewed | P14 PA-16 | P14-A02 | (i), (j) | Head of IT | Yes | Standard | 12 | Not tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jan 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20 | |||
| EXAMPLE | CT-21 | Break-glass accounts tested and every use reviewed | P14 PA-12 | P14-A02 | (i), (j) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Apr 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21 | |||
| EXAMPLE | CT-22 | Security induction completed | P16 AW-05 | P16-A02 | (g) | Information Security Manager | Yes | Standard | 12 | Effective | 31 Aug 2026 | Effective | Yes | 31 Aug 2027 | End of the last tested period | Not due | 1 Mar 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21 | |
| EXAMPLE | CT-23 | Annual security course completed | P16 AW-04 | P16-A02 | (g) | Information Security Manager | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jul 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23 | |||
| EXAMPLE | CT-24 | Post-incident review held | P09 IM-11 | P09-A02 | (b) | Information Security Manager | Yes | Standard | 12 | Effective | 31 Aug 2026 | Effective | Yes | 31 Aug 2027 | End of the last tested period | Not due | 1 Mar 2027 | With its operating test (CA-02) | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23 | |
| EXAMPLE | CT-25 | Incident response exercised | P10 EX-02 | P10-A02 | (f) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jun 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25 | |||
| EXAMPLE | CT-26 | After-action report approved | P10 EX-09 | P10-A12 | (f) | Chief Operating Officer | No | Lower | 24 | Never tested | No | 1 Oct 2028 | Start of the first plan year, or the control's start if later (CA-15) | Not due | Next plan year (Lower: 24-month cycle) | 1 Sep 2027 | No | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25 | |||
| EXAMPLE | CT-27 | Notification readiness checked | P18 RN-17 | P18-A08 | None | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 May 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25, CT-27 | |||
| EXAMPLE | CT-28 | Maturity assessed each year | P19 MA-17 | P19-A03 | (f) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Oct 2026 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25, CT-27, CT-28 | |||
| EXAMPLE | CT-29 | Supplier High findings escalated | P06 TP-08 | P06-A02 | (d) | Information Security Manager | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jun 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25, CT-27, CT-28, CT-29 | |||
| EXAMPLE | CT-30 | Triggered risk reassessment | P05 RM-10 | P05-A02 | (a) | Head of Information Security | Yes | Standard | 12 | Never tested | No | 1 Oct 2027 | Start of the first plan year, or the control's start if later (CA-15) | Not due | 1 Jun 2027 | With its operating test (CA-02) | Yes | CT-01, CT-02, CT-03, CT-05, CT-07, CT-09, CT-10, CT-15, CT-17, CT-18, CT-19, CT-20, CT-21, CT-23, CT-25, CT-27, CT-28, CT-29, CT-30 |
Tests
One row per workpaper (Control Test Workpaper Template). The sample size and the conclusion calculate by CA-05 and CA-07; a conclusion is final only when the reviewer signs (CA-11).
| Row | Workpaper | Control ID | Risk rating when tested | Tested on | Testing period from | Testing period to | Design | Population | Sample size (calc, CA-05) | Exceptions in the sample | Exceptions among the added occurrences | Automated control | Operating conclusion (calc, CA-07) | Tester | Reviewer | Reviewer signed on | Independence check (calc, CA-10, CA-11) | Concluded and final (calc) | Result reported (calc) | Population source | What the tester found | Concluded key (working) | Latest key (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | WP-2026-01 | CT-16 | Standard | 21 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 38 | 5 | 1 | 0 | No | Effective | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | Yes | Effective | HR system leavers report, 1 Mar to 31 Aug 2026 | L-2026-031's ERP account stayed enabled for 19 days after the last working day. The May reconciliation (CT-18) found and disabled it. One exception, so five more leavers were tested (CA-07): none failed. Effective, with the exception recorded and CT-18 noted as having caught it (CA-08). | CT-16|46265 | CT-16|46286 |
| EXAMPLE | WP-2026-02 | CT-13 | Standard | 22 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 34 | 5 | 2 | No | Not effective | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | Yes | Not effective | Remediation tracker export of Priority 1 and 2 findings due 1 Mar to 31 Aug 2026 | VUL-2026-0301 and VUL-2026-0318 were fixed after their June deadlines, with no deferral requested (P17 PM-14). Two exceptions: Not effective. P19's assessment found the same misses (MP-18). | CT-13|46265 | CT-13|46287 | |
| EXAMPLE | WP-2026-03 | CT-22 | Standard | 23 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 61 | 20 | 0 | No | Effective | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | Yes | Effective | HR system joiners report, 1 Mar to 31 Aug 2026, with the learning system's completion dates | All 20 sampled joiners completed the induction within 10 working days of their start date. | CT-22|46265 | CT-22|46288 | |
| EXAMPLE | WP-2026-04 | CT-04 | Standard | 23 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 24 | 5 | 0 | No | Effective | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | Yes | Effective | Risk register review history: 12 risks, March and June quarters | Each of the five sampled reviews was made in its quarter by the owner the register names, with a decision recorded. | CT-04|46265 | CT-04|46288 | |
| EXAMPLE | WP-2026-05 | CT-24 | Standard | 24 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 1 | 1 | 0 | No | Effective | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | Yes | Effective | Incident log: Severity 1 and 2 incidents closed 1 Mar to 31 Aug 2026 | INC-2026-014, closed on 21 Aug 2026, had its review on 27 Aug 2026, four working days later, with an owner and due date for each action; R-04 was reassessed on 20 Aug 2026 (P05). | CT-24|46265 | CT-24|46289 | |
| EXAMPLE | WP-2026-06 | CT-20 | Standard | 24 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Adequate | 0 | 0 | 0 | No | Not tested | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | No | Not tested | Privileged access review records | Design walked through on the Privileged Access Standard approved on 18 Sep 2026. Not tested: no review has yet fallen due; the first is due by 21 Dec 2026. | CT-20|46289 | ||
| EXAMPLE | WP-2026-07 | CT-02 | Higher | 25 Sep 2026 | 1 Mar 2026 | 31 Aug 2026 | Deficient | No | Not tested | Quality and Compliance Manager | Internal Audit Manager | 28 Sep 2026 | OK | No | Design deficient | Policy documents and their approval records | Design deficient: with no register of review dates, nothing shows when a review falls due, and there is no cryptography policy to review (CA-01). Operation not tested until the design is fixed. | CT-02|46290 |
Deficiencies
One row per deficiency, from the Control Deficiency & Remediation Tracker. Severity, the plan date and the due date calculate (CA-12, CA-13). A deficiency closes only on a passed retest (CA-14).
| Row | Deficiency ID | Control ID | From workpaper | Design or operating | Key control (calc) | Compensating control tested effective | Leaves a risk outside appetite or a recorded unmet obligation without its control | Only the record falls short of the evidence standard | Severity (calc, CA-12) | Control owner | Confirmed by the reviewer on | Plan agreed by (calc, CA-13) | Due (calc, CA-13) | Status | Fixed on | Open (calc) | Past its due date (calc) | Days to due date (calc) | Finding | Remediation | Linked work, due by the deficiency's date | Related later work | Retest from | Open deficiencies, so far (working) | Past due, so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DF-01 | CT-13 | WP-2026-02 | Operating | Yes | No | No | No | High | Head of IT | 28 Sep 2026 | 12 Oct 2026 | 27 Dec 2026 | Open | Yes | No | 88 | Two of five sampled Priority 1 and 2 findings were fixed after their deadlines with no deferral. | Bring the ordering platform's patching back within deadline, and defer every miss as an exception before its deadline | P05 TA-03 | P19 MF-11 | 2 Nov 2026 | DF-01 (CT-13, High) | ||
| EXAMPLE | DF-02 | CT-02 | WP-2026-07 | Design | Yes | No | Yes | No | High | Head of Information Security | 28 Sep 2026 | 12 Oct 2026 | 27 Dec 2026 | Open | Yes | No | 88 | No register records when each policy is due for review, and there is no cryptography policy. | Keep a policy register with an approval and review date for every policy, and have the board approve the cryptography policy | P12 GAP-01; P19 MF-01 | None | 1 Feb 2027 | DF-01 (CT-13, High); DF-02 (CT-02, High) |
Exceptions recorded on tests concluded Effective (CA-07, CA-08)
A sampled occurrence that fails an attribute is an exception, even if another control later caught and corrected it. The other control counts when the deficiency is rated (CA-12), not when this control is concluded. This differs from P19's MA-05 on purpose: P19 rates a whole practice with its checks, P20 one control. Each one is named here, though it is not a deficiency.
| Row | Workpaper | Control ID | Occurrence | What happened | ||||
|---|---|---|---|---|---|---|---|---|
| EXAMPLE | WP-2026-01 | CT-16 | L-2026-031 | ERP account disabled 19 days after the last working day, by the May reconciliation (CT-18) | ||||
Plan Progress
One row per test the Annual Control Testing Plan sets, by the month its fieldwork runs. Enter the date each workpaper is signed. A test is delivered when the reviewer signs it by the end of its month plus the review days (CA-11, CAM-06).
| Row | Control ID | Control (calc) | Planned month | Test | Tester | Note | Workpaper final on | Plan quarter (calc) | Due by the As-at date (calc) | Final by: month end plus review days (calc, CA-11) | Final in time (calc) | Status (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CT-03 | Joiners acknowledge policies | 1 Oct 2026 | Operating | Information Security Manager | Q1 | No | 13 Nov 2026 | Not due yet | |||
| EXAMPLE | CT-05 | Exceptions approved and renewed in time | 1 Oct 2026 | Operating | Quality and Compliance Manager | Q1 | No | 13 Nov 2026 | Not due yet | |||
| EXAMPLE | CT-28 | Maturity assessed each year | 1 Oct 2026 | Operating | Quality and Compliance Manager | Q1 | No | 13 Nov 2026 | Not due yet | |||
| EXAMPLE | CT-07 | Tier 1 suppliers reassessed in time | 1 Nov 2026 | Operating | Quality and Compliance Manager | Higher: first of two | Q1 | No | 14 Dec 2026 | Not due yet | ||
| EXAMPLE | CT-17 | Movers' old access removed | 1 Nov 2026 | Operating | Quality and Compliance Manager | Q1 | No | 14 Dec 2026 | Not due yet | |||
| EXAMPLE | CT-01 | Board report from checked figures | 1 Dec 2026 | Operating | Quality and Compliance Manager | Q1 | No | 14 Jan 2027 | Not due yet | |||
| EXAMPLE | CT-18 | Monthly account reconciliation | 1 Dec 2026 | Operating | Quality and Compliance Manager | Q1 | No | 14 Jan 2027 | Not due yet | |||
| EXAMPLE | CT-06 | Monthly exception register review | 1 Dec 2026 | Operating | Quality and Compliance Manager | Q1 | No | 14 Jan 2027 | Not due yet | |||
| EXAMPLE | CT-02 | Policy reviews on time | 1 Jan 2027 | Design | Quality and Compliance Manager | DF-02: design re-checked once the register exists | Q2 | No | 12 Feb 2027 | Not due yet | ||
| EXAMPLE | CT-20 | Privileged access reviewed | 1 Jan 2027 | Operating | Quality and Compliance Manager | First review due by 21 Dec 2026 | Q2 | No | 12 Feb 2027 | Not due yet | ||
| EXAMPLE | CT-15 | Missed patch deadlines deferred | 1 Jan 2027 | Operating | Quality and Compliance Manager | Q2 | No | 12 Feb 2027 | Not due yet | |||
| EXAMPLE | CT-13 | Urgent vulnerabilities fixed in time | 1 Feb 2027 | Retest | Quality and Compliance Manager | DF-01 retest; Higher: first of two | Q2 | No | 12 Mar 2027 | Not due yet | ||
| EXAMPLE | CT-08 | Metric inputs checked before reporting | 1 Feb 2027 | Operating | Quality and Compliance Manager | Q2 | No | 12 Mar 2027 | Not due yet | |||
| EXAMPLE | CT-09 | NIS2 readiness self-assessed | 1 Feb 2027 | Operating | Quality and Compliance Manager | Q2 | No | 12 Mar 2027 | Not due yet | |||
| EXAMPLE | CT-16 | Leavers' access removed | 1 Mar 2027 | Operating | Quality and Compliance Manager | Before the customer review | Q2 | No | 14 Apr 2027 | Not due yet | ||
| EXAMPLE | CT-22 | Security induction completed | 1 Mar 2027 | Operating | Quality and Compliance Manager | Before the customer review | Q2 | No | 14 Apr 2027 | Not due yet | ||
| EXAMPLE | CT-19 | User access reviews | 1 Mar 2027 | Operating | Quality and Compliance Manager | Before the customer review | Q2 | No | 14 Apr 2027 | Not due yet | ||
| EXAMPLE | CT-24 | Post-incident review held | 1 Mar 2027 | Operating | Quality and Compliance Manager | Before the customer review | Q2 | No | 14 Apr 2027 | Not due yet | ||
| EXAMPLE | CT-21 | Break-glass accounts tested and every use reviewed | 1 Apr 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 May 2027 | Not due yet | |||
| EXAMPLE | CT-12 | Disposal certificates collected | 1 Apr 2027 | Design | Quality and Compliance Manager | Lower: design checked each year (CA-02); operation tested next year | Q3 | No | 14 May 2027 | Not due yet | ||
| EXAMPLE | CT-07 | Tier 1 suppliers reassessed in time | 1 May 2027 | Operating | Quality and Compliance Manager | Higher: second of two | Q3 | No | 14 Jun 2027 | Not due yet | ||
| EXAMPLE | CT-10 | Board members trained | 1 May 2027 | Operating | Information Security Manager | Q3 | No | 14 Jun 2027 | Not due yet | |||
| EXAMPLE | CT-27 | Notification readiness checked | 1 May 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 Jun 2027 | Not due yet | |||
| EXAMPLE | CT-25 | Incident response exercised | 1 Jun 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 Jul 2027 | Not due yet | |||
| EXAMPLE | CT-29 | Supplier High findings escalated | 1 Jun 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 Jul 2027 | Not due yet | |||
| EXAMPLE | CT-30 | Triggered risk reassessment | 1 Jun 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 Jul 2027 | Not due yet | |||
| EXAMPLE | CT-11 | Information register reviewed | 1 Jun 2027 | Operating | Quality and Compliance Manager | Q3 | No | 14 Jul 2027 | Not due yet | |||
| EXAMPLE | CT-02 | Policy reviews on time | 1 Jul 2027 | Retest | Quality and Compliance Manager | DF-02 operating retest; Higher | Q4 | No | 13 Aug 2027 | Not due yet | ||
| EXAMPLE | CT-04 | Quarterly risk review | 1 Jul 2027 | Operating | Quality and Compliance Manager | Q4 | No | 13 Aug 2027 | Not due yet | |||
| EXAMPLE | CT-23 | Annual security course completed | 1 Jul 2027 | Operating | Quality and Compliance Manager | Q4 | No | 13 Aug 2027 | Not due yet | |||
| EXAMPLE | CT-13 | Urgent vulnerabilities fixed in time | 1 Aug 2027 | Operating | Quality and Compliance Manager | Higher: second of two | Q4 | No | 14 Sep 2027 | Not due yet | ||
| EXAMPLE | CT-14 | Vendor releases reviewed | 1 Aug 2027 | Design | Quality and Compliance Manager | Lower: design checked each year (CA-02); operation tested next year | Q4 | No | 14 Sep 2027 | Not due yet | ||
| EXAMPLE | CT-26 | After-action report approved | 1 Sep 2027 | Design | Quality and Compliance Manager | Lower: design checked each year (CA-02); operation tested next year | Q4 | No | 14 Oct 2027 | Not due yet |
By NIS2 Point
By NIS2 Article 21(2) point: controls whose source documents cite it
For each point of Article 21(2), the controls on the Controls sheet whose source document cites that point in its own framework references, and how many of them are tested within their cycle and Effective. This is the documents' citation, counted. It is not a statement that any point is met, and a point with no control here is not, on that ground, a gap.
| Point | Measure | NIS2's words | Controls whose source documents cite this point | Of those, tested within their cycle | Of those, Effective at their last test | Written as | Note |
|---|---|---|---|---|---|---|---|
| (a) | Risk analysis and security policies | “policies on risk analysis and information system security” | 6 | 1 | 1 | 1 of 6 tested; 1 of 1 effective | |
| (b) | Incident handling | “incident handling” | 1 | 1 | 1 | 1 of 1 tested; 1 of 1 effective | |
| (c) | Business continuity and crisis management | “business continuity, such as backup management and disaster recovery, and crisis management” | 0 | 0 | 0 | No control's source document cites it | Restore testing is not in the control set. Add your own control to the inventory if you rely on one, quoting the Cyber Resilience & Recovery pack's RR-14 or a rule of the Backup & Restore Assurance pack. |
| (d) | Supply chain security | “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | 2 | 0 | 0 | 0 of 2 tested; 0 of 0 effective | |
| (e) | Security in acquisition, development and maintenance | “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | 3 | 1 | 0 | 1 of 3 tested; 0 of 1 effective | |
| (f) | Assessing effectiveness | “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | 4 | 0 | 0 | 0 of 4 tested; 0 of 0 effective | |
| (g) | Cyber hygiene and training | “basic cyber hygiene practices and cybersecurity training” | 2 | 1 | 1 | 1 of 2 tested; 1 of 1 effective | |
| (h) | Cryptography and encryption | “policies and procedures regarding the use of cryptography and, where appropriate, encryption” | 0 | 0 | 0 | No control's source document cites it | |
| (i) | People, access and assets | “human resources security, access control policies and asset management” | 10 | 1 | 1 | 1 of 10 tested; 1 of 1 effective | |
| (j) | Multi-factor authentication and secured communications | “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate” | 2 | 0 | 0 | 0 of 2 tested; 0 of 0 effective | |
| A control counts under every point its source document cites, so the rows do not add up to the number of controls. Which requirement you rely on a control for is your own record in the Unified Control Framework Mapping Workbook, not this sheet's. | |||||||
By the requirements you rely on your controls for
Yours to fill, from the Unified Control Framework Mapping Workbook: one row per requirement you report on, the controls you rely on for it, and how many of those are tested within their cycle and Effective, from the Controls sheet. Count them; do not turn them into a share (CA-19).
| Requirement set | Requirement, in its own words | Controls you rely on for it | How many | Of those, tested | Of those, Effective | Written as | Note |
|---|---|---|---|---|---|---|---|
| [[e.g. a requirement set]] | [[the requirement, as the workbook lists it]] | [[the control IDs]] |
Lists
| YesNo | DesignConclusion | DeficiencyKind | DeficiencyState | PlannedTest |
|---|---|---|---|---|
| Yes | Adequate | Design | Open | Operating |
| No | Deficient | Operating | Plan agreed | Design |
| Fixed, awaiting retest | Retest |
Closed
Deferred as an exception
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| CAM-01 Controls tested within their cycle | Controls whose last operating test, concluded Effective or Not effective, covered a period ending within their test cycle, out of the controls in the inventory. Target: All, by the end of each control's first cycle. |
| CAM-02 Tested controls effective | Controls whose last operating test concluded Effective, out of the controls tested. Target: All. |
| CAM-03 Key controls never tested | Key controls with no operating test concluded, by name. Target: None after the first plan year. |
| CAM-04 Open deficiencies by severity | Deficiencies not yet closed by a passed retest, counted High, Medium and Low. Target: No High open past its due date. |
| CAM-05 Deficiencies past their due date | Deficiencies not yet fixed when their due date passed, with no approved deferral, by name. A deficiency fixed by its due date and waiting for its retest is open (CAM-04) but not past due. Target: None. |
| CAM-06 Planned tests delivered | Tests final, with the reviewer's signature, by the end of the month the plan set plus the review time (CA-11), out of the tests the plan set for the year to date. Target: All; any slip recorded with its new date. |
| Control | Something done routinely to keep a risk in check, written as who does what, how often, and the record it leaves (CA-01). |
| Key control | A control whose failure, on its own, would let a risk on the register happen or go unnoticed, or that the organisation names as its evidence for an obligation. Key controls are never rated Lower risk. |
| Control owner | The manager accountable for a control running and leaving its record. Agrees test dates, provides access to records and fixes deficiencies. |
| Tester | The person who tests a control. Owns and performs none of the controls they test (CA-10). |
| Design test | A check that the control, as written and as set up, would prevent or detect the risk if it ran: a walkthrough of one occurrence from start to record (CA-02). |
| Operating test | A check, on a sample chosen by the tester, that the control ran as designed throughout the testing period (CA-04 to CA-07). |
| Population | Every occurrence of the control in the testing period, taken by the tester from the system of record, with a check that the list is complete (CA-04). |
| Sample | The occurrences the tester chooses from the population, spread across the testing period. The owner never chooses them (CA-04, CA-05). |
| Testing period | The months the operating test covers: since the control was last tested, and never longer than its test cycle (CA-06). |
| Exception | A sampled occurrence that fails any attribute (CA-07, CA-08). |
| Deficiency | A design that would not keep the risk in check, or an operating test concluded Not effective. Rated High, Medium or Low (CA-12). |
| Compensating control | Another control that keeps the same risk in check when this one fails. It counts only once it has been tested and found effective (CA-12). |
| Retest | An operating test of a fixed control, made after it has run enough times to sample, by someone other than its owner. A deficiency closes only on a retest that passes (CA-14). |
| Workpaper | The record of one test: population and its source, sample, attributes, results, exceptions, conclusion, tester and reviewer (CA-11). |
| Risk rating | Each control is rated Higher, Standard or Lower risk, and tested at least every 6, 12 or 24 months respectively. A control never tested is due within one cycle of the start of the first plan year, or of the day it started if that is later; one whose design was found deficient, within one cycle of the day its design is found adequate. A key control is never Lower, and a control that failed its last test is Higher until a retest passes. When each rating applies is in the settings on the Summary sheet. |
| Severity | Every design deficiency and every Not effective result is a deficiency. High: a key control failed and no compensating control was tested effective, or the failure leaves a risk outside appetite or a recorded unmet obligation without its control. Medium: a key control failed but a compensating control was tested effective, or a control that is not key failed. Low: the control ran, but its record falls short of the evidence standard. |
| Effective | No exception in the sample; or one exception in a manual control whose population is at least twice the sample, with none among the occurrences added (CA-07). |
| Not effective | Any other result with an exception (CA-07). It is a deficiency (CA-12). |
| Not tested | The control had not run in the testing period, or its design was found deficient, so its operation was not tested (CA-01, CA-06). |
| Design deficient | The design check found the control could not keep its risk in check as written or set up. Its operation is not tested until the design is fixed (CA-01). |
| Never tested | No workpaper on the Tests sheet for the control. |
| Awaiting review | The test is not final until the reviewer signs (CA-11), so it is not reported as a conclusion. |
| Tested within its cycle | The control's last concluded operating test covered a period ending no more than its test cycle before the As-at date. |
| Next operating test due | The end of the last tested period plus the test cycle (CA-15). For a control never tested, one cycle from the start of the first plan year, or from the day the control started if that is later; for one whose design was found deficient, one cycle from the day its design is found adequate (CA-15). Until then it has no operating due date (CA-01). |
| Overdue | The next operating test was due before the As-at date. |
| Next planned operating test, next planned design check | The first operating test or retest, and the first design check, that the plan sets from the As-at date's month. A design check runs with every operating test (CA-02); a Lower-risk control whose operation waits for the next plan year has its own design check row. |
| NIS2 points its source document cites | The points of NIS2 Article 21(2) that the control's source document cites in its own framework references. It says what the document helps with; it does not say the control meets the point. |
| As-at date | The date every flag and measure is worked out at: the quarter's last day. |
| Assurance sponsor | The member of management who approves the test plan, receives the dashboard, and decides when a High deficiency is overdue. |
| Control assurance lead | The person who runs control testing: keeps the inventory and the plan, assigns testers, reviews workpapers, and rates deficiencies. Owns and performs no control in scope. |
| (calc), (working) | A column or cell the workbook calculates. Do not type or paste over it. Working columns hold running lists other cells read. |
| CA-nn, CT-nn, CAM-nn | The rules, controls and headline measures of the Control Testing Methodology. WP-nnnn-nn are workpapers; DF-nn deficiencies. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026, after its pilot round TR-2026-P. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is tested, when, and the results evaluated and reported to management each quarter |
| NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Summary sheet: test results put before management each quarter, with the decision each measure supports |
| NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | Summary sheet: what the management body sees each quarter to oversee the measures it approved. The dashboard informs that oversight; it does not discharge it |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The dashboard as a whole: the results of testing whether controls work, reported to management on a set cycle. Part of assessing effectiveness, not the whole of it |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Applies to the providers its Article 1 names. For them, the Annex points below; for others, a useful guide only |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.1 — regularly review compliance with the network and information system security policies, topic-specific policies, rules and standards; “The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.” | Summary sheet: regular reporting to management on whether the controls the policies set are working. For the providers Article 1 names, the results can feed the compliance reviews; the dashboard is not that review |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 2.2.2 — an effective compliance reporting system, appropriate to the entity’s structures, operating environments and threat landscapes, “capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks” | Summary, Deficiencies and Plan Progress sheets: a current view for management of which controls are tested, which work and what is being fixed (providers Article 1 names) |
| DORA — Regulation (EU) 2022/2554 | Article 5(2) — the management body defines, approves, oversees and is responsible for the ICT risk management framework, bears ultimate responsibility for ICT risk and sets the risk tolerance | Summary sheet, for financial entities: information the management body can use to oversee the ICT risk management framework it is responsible for |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 27(2) — the report on the review of the ICT risk management framework (DORA Article 6(5)) contains, among other things, an executive-level summary of the ICT risk profile, threat landscape, “the assessed effectiveness of its controls” and security posture; the date of the management body’s approval; the reason for the review; the function responsible; the findings, with an assessment of the severity of weaknesses, deficiencies and gaps; the measures to address them, with expected dates, responsible functions and resource impact; the criteria for accepting residual risk where gaps are not remedied; planned developments; and the state of corrective measures from past reviews | Deficiencies sheet and CAM-02 to CAM-05, for financial entities: the tested effectiveness of controls and the severity of each deficiency, which can feed the review report. The dashboard is not that report |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.