For a NIS2 review, build one evidence pack per Article 21 measure area, plus proof that management approved the measures and a tested incident reporting process that meets the 24 hour, 72 hour and one month stages of Article 23. NIS2 is a directive, so national law and your regulator decide the details. Check your country.
Who reviews you, and how?
NIS2, Directive (EU) 2022/2555, replaced the earlier NIS directive. The European Commission's page describes it as a unified legal framework for cybersecurity in 18 critical sectors, applying as a rule to medium sized and large entities in those sectors, with supervision and enforcement provisions and accountability for top management. Member States transpose it into national law and designate authorities, so there is no single EU auditor. Your supervisory review, if any, comes from your national competent authority, and the exact process and penalties depend on your country.
The Commission's page also notes that on 20 January 2026 it proposed targeted amendments to simplify compliance. Check where those stand before you finalise anything.
What do the measures cover?
Article 21(2) says measures must be based on an all hazards approach and include at least ten areas: policies on risk analysis and information system security; incident handling; business continuity such as backup management, disaster recovery and crisis management; supply chain security; security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure; policies to assess the effectiveness of measures; basic cyber hygiene and training; cryptography and encryption policies; human resources security, access control and asset management; and multi factor or continuous authentication, secured communications and emergency communication where appropriate.
Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, with proportionality judged by exposure, size, likelihood and severity of incidents. Article 21(3) tells you to consider each direct supplier's vulnerabilities and overall quality of products and security practices, including secure development procedures. Article 21(4) requires corrective measures without undue delay when you find non compliance.
What does the evidence pack look like?
Create ten folders, one per area, each with the same five items: the policy or procedure, the owner, the evidence it operates, the last review date and open gaps.
Examples of operating evidence: risk assessment with dates and approvals; incident tickets and exercise notes; a restore test and a crisis plan; a supplier register with risk ratings and contract clauses; vulnerability scan reports with remediation times and a disclosure process; effectiveness reviews or internal audit reports; training records; encryption standards and key management notes; access reviews and an asset inventory; multi factor authentication enforcement settings.
Add three cross cutting items.
Management approval. Article 20 requires management bodies to approve the cybersecurity risk management measures, oversee implementation and potentially bear liability, and to follow training. Keep minutes showing approval and attendance records for training.
Reporting readiness. Article 23 requires notifying the CSIRT or competent authority of significant incidents without undue delay, with an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the notification. Keep a template for each stage, a decision tree for what counts as significant, contact details and rehearsal records.
Scope determination. A note recording whether you are an essential or important entity, by what reasoning and under which national rules.
How do reviewers test?
Expect document requests, interviews with owners and technical samples. They will look for consistency between policy and practice, proof that measures are proportionate to your risk and that gaps have corrective plans, as Article 21(4) demands.
What mistakes recur?
- Treating NIS2 as a copy of ISO 27001 and not checking national rules.
- No management approval trail.
- Supplier security listed but not assessed.
- A reporting process nobody has rehearsed against the 24 hour clock.
- Measures described in policy only.
- Ignoring entities in your group that fall under different national laws.
What to do
- Confirm whether you are in scope and under which national law.
- Create the ten area folders and fill each with policy, owner, evidence and gaps.
- Get management to approve the measures in minutes and complete training.
- Build and rehearse the reporting process, timed against 24 hours and 72 hours.
- Review suppliers and record outcomes.
- Run a mock review with an outsider sampling three areas.
- Track corrective actions to closure with dates.
Quick check
What are the NIS2 incident reporting stages?
Under Article 23, an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification.
Is there an EU wide NIS2 certificate?
The directive sets obligations and supervision through national authorities. Check your national rules and whether schemes or standards are recognised in your country.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 20, 21 and 23.
- European Commission, NIS2 Directive: securing network and information systems, fetched 18 October 2026.
How Safeguard helps automate this
Ten evidence folders are a lot to keep current by hand. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between reviews. Supply chain and vulnerability handling, two of the Article 21 areas, benefit most: technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Safeguard helps you prepare and keep evidence ready; your competent authority decides on compliance. Book a call.
Last reviewed: 18 October 2026.
