Short answer
NIS2 does not prescribe one audit certificate or one audit format. The obligated entity must be able to evidence that risk management, the ten duties, supply-chain security, incident handling and management accountability operate. An audit is a structured check of that evidence; a checklist is only a starting point.
Audit scope
- Risk: asset and risk register, treatment plan, owners.
- Ten duties: access, cryptography, continuity, backup, vulnerability handling, MFA and more.
- Incidents: detection, 24/72-hour reporting and final report.
- Supply chain: due diligence, contract clauses and subcontractors.
- Governance: board approval, training and accountability.
- Evidence: dates, owners, test results and corrective actions.
Evidence that matters
| Duty | Evidence |
|---|---|
| Risk analysis | Register with likelihood, impact, treatment and owner |
| Incident handling | Log, notification history and tabletop record |
| Continuity | Backup restore test and RTO/RPO |
| Supply chain | Supplier inventory, due diligence and contract clauses |
| Access | Role review, MFA coverage and privileged access |
| Governance | Board minutes, risk appetite and training records |
A policy with no operating evidence is weak. Prefer a small number of dated, owned artifacts over a large unverified folder.
How an audit runs
- Scope: entities, services, systems and critical suppliers.
- Evidence request: a short list mapped to the ten duties.
- Interviews and sampling: test whether the control operates.
- Findings: impact, evidence, fix and owner.
- Report: priorities and a retest option.
Start with the registration and incident process if those are not yet documented.
Common gaps
- Risk register exists, but no treatment dates or owners.
- MFA is deployed, but coverage is not measured.
- Backups run, but restore is not tested.
- Suppliers are listed, but not assessed.
- Board approval is missing or undated.
- Incident reporting exists only on paper.
Review the broader cybersecurity audit scope or request a scoping call.
Frequently asked questions
Does NIS2 require a mandatory audit certificate?
No. NIS2 does not create one mandatory audit certificate. Supervisors and customers can ask you to evidence that the ten duties operate; an internal or independent audit can produce that evidence.
What does a NIS2 audit cover?
Risk analysis, incident handling, continuity and backup, supply-chain security, access control, training, cryptography, vulnerability handling, MFA and governance.
Is a checklist enough?
No. A checklist shows intent. An audit checks evidence that the control operates, with an owner, date and result.
How long does it take?
It depends on scope and evidence quality. A focused review can take days; a multi-entity group with weak evidence takes longer. Agree the scope in writing first.