NIS2 does not treat an audit as a finish line. Article 21 requires entities to keep policies and procedures that assess whether their cybersecurity measures are effective, and Article 23 sets reporting clocks of 24 hours and 72 hours for significant incidents. In practice that means monitoring, evidence and rehearsed response, kept running all year.
Where does the directive say this?
The text is Directive (EU) 2022/2555. Article 21(2) lists the minimum measures an essential or important entity must cover. Three of them matter most once the audit is behind you:
- (d) supply chain security, including the relationships with direct suppliers and service providers.
- (e) security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure.
- (f) "policies and procedures to assess the effectiveness of cybersecurity risk-management measures".
Item (f) is the continuous monitoring hook. The directive does not name a tool or a frequency. It asks you to be able to show that you check, and what you found.
What is the difference between audit evidence and monitoring evidence?
An audit gives you a snapshot. A reviewer samples controls on a date and writes a conclusion. Monitoring gives you a record of what happened between audits: scans that ran, findings that opened, fixes that closed, exceptions someone approved.
Think of two reviewers arriving next spring. One asks, "Show me your vulnerability handling process." The other asks, "Show me what happened to the last five critical findings." The first needs a document. The second needs a trail with dates and owners. NIS2 supervisors can reasonably ask for either.
What are the incident clocks?
Article 23(4) sets three steps for a significant incident:
- An early warning without undue delay and in any event within 24 hours of becoming aware.
- An incident notification within 72 hours of becoming aware.
- A final report not later than one month after the incident notification.
You cannot meet a 24 hour clock if detection depends on someone noticing a spreadsheet next week. Monitoring is what starts the clock early enough to act on it.
What should you monitor?
Start from the Article 21(2) items and ask what signal proves each one is alive.
- Vulnerability handling (e): new findings per week, time to fix by severity, and open items past your own deadline.
- Supply chain (d): changes in your dependency inventory and in supplier software you consume. A software bill of materials per release gives you something to diff.
- Effectiveness (f): the review itself. A calendar entry, an owner, and a written output each quarter.
- Hygiene and access (g, i, j): MFA coverage, joiner and leaver checks, and asset inventory drift.
Resist the urge to monitor everything. Ten signals someone reads beat sixty dashboards nobody opens.
Where can tooling help?
Compliance automation can map scan results to framework requirements and keep the evidence in one place. Safeguard documents a NIS2 entry in its framework library, and its docs explain that for each framework some requirements are decided by a scan while others need evidence a scan cannot see, such as a policy or an access review. That split is the honest way to think about it: automation covers the technical signals, people cover the rest. No tool makes an organisation compliant on its own, and Safeguard does not certify you against NIS2.
What to do
- Write one line per Article 21(2) item: the control, the signal, the owner.
- Pick a review cadence for item (f), quarterly is a sensible start, and record the output each time.
- Make vulnerability findings and fixes leave a dated trail outside people's heads.
- Generate an SBOM per release and keep the history.
- Rehearse the 24 hour early warning once with a tabletop exercise. Time it.
- Check your national transposition. Member states implement the directive in their own laws, so deadlines and regulators differ.
Quick check
Does a passed audit mean I am compliant with NIS2 from then on?
No. An audit is a point in time. Article 21 expects measures and effectiveness checks to continue, and Article 23 applies whenever a significant incident occurs.
How fast must a significant incident be reported?
An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month of the notification.
Does NIS2 name a specific monitoring tool?
No. The directive sets outcomes, not products. You choose the means and keep evidence that they work.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex, Articles 21 and 23.
- Safeguard documentation: compliance and frameworks.
This is general information, not legal advice.
Last reviewed: 18 October 2026.
