A NIS2 auditor looks for evidence of management approval of risk measures, the ten minimum measures in Article 21(2), and the ability to report incidents on the Article 23 timeline: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Your national authority sets the detail.
What does the directive itself say?
Directive (EU) 2022/2555 sets duties for essential and important entities. This post reads the EUR-Lex text, and national laws that transpose it may add detail, so check your member state's rules and your regulator's guidance.
Governance (Article 20). Management bodies approve the cybersecurity risk-management measures and oversee implementation, and can be held liable for infringements. Members must complete training, and entities should offer similar training to staff regularly.
Risk measures (Article 21(2)). Measures follow an all-hazards approach and include at least ten items.
Reporting (Article 23). An early warning without undue delay and within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours with an initial assessment of severity and impact, and a final report not later than one month after the notification.
What evidence fits each measure?
Mapped to the ten items:
- Risk analysis and system security policies. The approved policy, the risk register, the date of the last review and the approving body.
- Incident handling. The procedure, the roles, test records and past incident tickets.
- Business continuity. Backup logs, restore tests, disaster recovery plans and crisis exercises.
- Supply chain security. Supplier inventory, security terms in contracts, reviews of direct suppliers and service providers.
- Security in acquisition, development and maintenance, including vulnerability handling and disclosure. Vulnerability scan history, SBOMs, patch records, a disclosure policy.
- Effectiveness assessment. Internal audits, test results, metrics and action tracking.
- Cyber hygiene and training. Training completion records and hygiene baselines.
- Cryptography and encryption. The policy, key management records and configuration standards.
- Human resources security, access control and asset management. Joiner and leaver records, access reviews and an asset inventory.
- Multi-factor or continuous authentication, plus secured communications and emergency systems where appropriate. Enrollment reports and exception lists.
What will the reporting test look like?
Auditors want to see you could meet the clock. Evidence includes an incident severity rubric that defines "significant", a named contact for the authority, a template for each of the three submissions, and a tabletop exercise record showing the timings. The 24 hours starts when you become aware, so also show how awareness is recorded: who logs the time and where.
Where does software supply chain evidence help?
Two measures, supply chain security and secure development with vulnerability handling, depend on knowing what software you use and what you did about known flaws. Dated SBOMs and scan histories give an auditor a sample set they can verify, and the records show a process, not a promise.
Evidence from a tool is evidence. It is not a statement that you are compliant, and no vendor can issue one for you.
What do teams usually forget?
The management body piece. Article 20 makes approval and training a leadership matter, so keep minutes showing the board or equivalent approved the measures, with dates. Also keep supplier evidence current, and test the reporting path before a real incident forces the first run.
What to do
- Confirm whether you are an essential or important entity under your national law.
- Build an evidence index with one row per Article 21(2) item.
- Record management approval and training with dates.
- Write the three report templates and run a timed exercise.
- Set a scan and SBOM cadence and store results per release.
- Review supplier contracts for security and notification terms.
Quick check
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month after the notification, per Article 23(4).
Does a tool make me NIS2 compliant?
No. Tools help produce evidence, but compliance is judged against the directive and your national law.
Sources
- Directive (EU) 2022/2555 on EUR-Lex, fetched 18 October 2026.
Last reviewed: 18 October 2026.
