When Your NIS2 Checklist Stops Matching the Evidence

In one readiness assessment, the spreadsheet looked complete: controls, evidence links, owners and review dates. Everything was green. Management had signed off.

Then we checked three answers against the records behind them. Details of the engagement are anonymised.

• Access reviews: marked as quarterly, but the last review was fourteen months old. Three former employees still had active VPN credentials.
• Incident response: marked as tested annually, but the last tabletop exercise was twenty-two months old. The plan’s on-call rotation included two people who had left.
• Recovery: marked as tested monthly, but the last successful restore was eight months old. A later test had failed. The failure was in a ticket; it had never reached the compliance spreadsheet.

The records existed. The assessment no longer reflected them.

That is what I mean by mapping drift: the recorded status has stopped describing the process. It can happen in a spreadsheet or in a compliance platform.

Follow the evidence

If an answer says recovery is tested, find the test record. Check its date, systems covered, result and unresolved actions. A successful backup job shows that a backup ran. It does not show that the service was restored successfully.

Speak to the person responsible. Does the procedure match what they do? Can they find the same record? Has the system or supplier changed since the evidence was produced?

An assessment date and an evidence date are different facts. Reviewing a control today does not make last year’s test current.

What NIS2 adds

Article 21 addresses measures suited to the risks, including procedures for assessing their effectiveness. Article 20 addresses management approval and oversight. Confirm the national requirements that apply to your entity alongside the NIS2 directive.

Neither a spreadsheet nor a platform establishes effectiveness. The question is whether the evidence supports the conclusion for the service under review.

Reopen answers when the facts change

• An owner leaves. Reassign the task and check whether the last scheduled review happened.
• A system moves. Revisit backup scope, access paths and incident contacts after the migration.
• A test fails. Record the failure against the control and follow corrective work through to a retest.
• A supplier changes. Check which commitments and evidence still apply to the service you receive.
• An exception expires. Resolve it or arrange a fresh decision from someone with authority.

Each trigger needs an action, not just a reminder that can be dismissed.

Make the next review repeatable

Record the evidence source, date or period, covered systems, reviewer and outstanding issues. Keep a link to the source record where possible.

For an access review, retain the population checked and decisions made. A calendar invitation proves a meeting was scheduled; it does not establish whose access was reviewed or removed. For a recovery exercise, retain the tested scope and observed result, including what was left untested.

Choose frequency based on risk and the rate of change. Document why the schedule is suitable. A monthly review adds little if nobody has the authority or time to act on findings.

Report uncertainty as well as completion

Distinguish an operating control, a control with exceptions, missing evidence and work that has not been assessed. Those states require different decisions.

For missing evidence, state what would establish the answer. For a failed control, explain the consequence and proposed action. Calling both “in progress” hides the reason for concern.

Where AuditFront helps

AuditFront provides questions and a place to record evidence references. You still need to verify the records and update answers when the facts change. It does not monitor your systems or detect stale evidence automatically.

Use the NIS2 review workbook for a wider topic review, or start the short readiness check to identify priorities. The useful result is a set of conclusions you can trace back to evidence.