NIS2 audits: where do entities most often fall short?

There is no public, official ranking of NIS2 audit findings yet. What the directive does give us is a testable list: Article 21 measures, Article 23 reporting clocks and Article 20 management duties. Evidence gaps in those areas, especially supply chain and vulnerability handling, are the likeliest places an audit finds trouble.

Why is there no findings list?

NIS2 is a directive, so each Member State transposes it and runs its own supervision. We looked for a published, cross-country tally of audit findings and did not find one from the regulators or ENISA. Anyone quoting percentages for "top NIS2 findings" is either guessing or counting a narrow sample.

So treat the rest of this post as a reading of the text: what Directive (EU) 2022/2555 says an entity must be able to show, and where that evidence tends to be hard to produce.

What does Article 21 require you to show?

Article 21(1) asks for "appropriate and proportionate technical, operational and organisational measures". Article 21(2) lists the minimum, ten items from (a) to (j). Four of them tend to generate the awkward conversations.

Supply chain security, 21(2)(d). The text covers security aspects of relationships with direct suppliers and service providers. Evidence that is easy to lack: a current list of suppliers that touch your systems, what you asked each of them for, and what you did with the answers. A questionnaire filed once and never revisited is thin.

Vulnerability handling, 21(2)(e). This sits inside security in acquisition, development and maintenance, "including vulnerability handling and disclosure". An auditor can ask how you learn about a flaw in a component you ship, who decides priority, and how long the decision took. A scanner export with 4,000 open items and no triage record is a finding waiting to happen.

Effectiveness assessment, 21(2)(f). You need policies and procedures to assess whether the measures work. Many teams have controls and no test that they still function.

Multi-factor authentication, 21(2)(j). The directive says multi-factor or continuous authentication "where appropriate". The gap is usually an unexplained exception, such as a service account or an admin console, rather than a missing programme.

What about incident reporting?

Article 23(4) sets the clocks. An early warning is due "without undue delay and in any event within 24 hours of becoming aware of the significant incident". The incident notification follows within 72 hours, and a final report no later than one month after that notification.

The usual shortfall is not the template. It is that nobody can say, at hour three, who decides that an incident is significant. Write that decision rule down and rehearse it once.

Does management have to be involved?

Yes. Article 20(1) says management bodies approve the risk-management measures, oversee their implementation, and can be held liable for infringements. Article 20(2) requires training for members of those bodies. Minutes that show approval and a training record are the evidence.

What are the penalties?

Article 34 sets maximums, and Member States may set higher. For essential entities, the maximum is at least EUR 10 000 000 or 2 percent of worldwide annual turnover, whichever is higher. For important entities it is at least EUR 7 000 000 or 1.4 percent.

What to do

1. Map each Article 21(2) item (a) to (j) to a named owner and a document or log that proves it.
2. Build a supplier register and record what you requested and received from each, including SBOMs where products ship software.
3. Keep a triage record for vulnerabilities: who decided, when, and why a finding was accepted or deferred.
4. Define "significant incident" in writing and test the 24 hour and 72 hour clocks in a tabletop.
5. Record management approval and training with dates.
6. List every MFA exception and give each an owner and an expiry.
7. Check your national transposition law, since supervision and deadlines differ by country.

How does Safeguard fit?

Safeguard does not certify anyone against NIS2. Its docs list an EU NIS2 framework page covering what a scan checks, its controls, policy templates and automated tests. That helps with the technical evidence for items such as 21(2)(d) and (e): dependency inventory, vulnerability findings and reachability context. Governance, training and incident decisions stay with you.

Quick check

Sources

• Directive (EU) 2022/2555 (NIS2), EUR-Lex, fetched 18 October 2026
• Safeguard compliance frameworks docs, fetched 18 October 2026

Last reviewed: 18 October 2026.