Documentation audit
How we review compliance documentation: evidence, consistency between documents, findings and the priority of corrective actions.
All articles
ACN supervision under NIS 2: inspections, orders and fines
For entities placed on the NIS list in April 2025, ACN gives October 2026 as the deadline for the baseline measures. How ACN supervises after that: m…
Cybersecurity Audit: What It Is, How It Works, and How to Prepare
A cybersecurity audit checks whether security governance, controls, evidence and technical practices are suitable for the chosen framework. This guid…
NIS 2 Executive Board Reporting: How to Turn Audit Outputs into Governance Decisions
Practical executive reporting model for NIS 2 audit outcomes with minimum KPI set, traffic-light escalation, and evidence-based closure visibility fo…
Prioritizing NIS 2 Audit Findings: From Gap List to Remediation Execution
Severity-to-execution model for NIS 2 audit findings with dependency-aware sequencing, triage criteria, and evidence-based closure tracking for remed…
Recurring NIS 2 Documentation Patterns and Quick Wins for Baseline Readiness
High-frequency recurring patterns in NIS 2 documentation and a quick-win framework for fast remediation of governance structure, evidence traceabilit…
NIS 2 Incident Management Documentation Review: Method, Gaps, and Remediation Priorities
Practical review model for NIS 2 incident-management documentation covering process integrity, notification readiness, role accountability, and crisi…
NIS 2 Compliance Documentation Audit: Interview and Evidence Collection Workflow
Structured interview and evidence collection workflow for NIS 2 documentation audits, with a 6-domain model, evidence maturity scale, and gap-to-reme…
Cross-Document Coherence in NIS 2 Documentation: Audit Method and Controls
Five-dimension coherence audit model for NIS 2 documentation sets covering terminology, roles, cross-references, review cycles, and incident flow con…
NIS 2 Documentation Audit Checklist: Operational Method for Baseline Readiness
Five-block operational checklist for NIS 2 documentary audit covering requirement mapping, evidence maturity, cross-document consistency, and governa…
NIS 2 Evidence Matrix and Board-Approval Readiness: Practical Audit Method
Practical method for building an NIS 2 evidence matrix with maturity scoring and board-approval readiness checks for baseline compliance audit.
NIS 2 Requirement-to-Document Mapping: Building a Defensible Audit Structure
Practical method for mapping NIS 2 baseline requirements to primary documents, supporting evidence, and governance controls to build a defensible aud…
NIS 2 Compliance Documentation Audit: How the Scoring Methodology Works
Aegister’s scoring methodology evaluates NIS 2 documents at requirement-point level across 5 dimensions on a 0-4 scale. This guide covers the scoring…
NIS 2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof
ACN baseline guidance requires documentary evidence as a core compliance element. Practical guide to evidence families, obligation-to-evidence mappin…
Compliance Documentation Audit for NIS 2 Baseline Obligations: Method Overview
A Compliance Documentation Audit maps NIS 2 documents to baseline requirements, scores maturity on a 0-4 scale, verifies evidence traceability, and c…
NIS 2 incident management and CSIRT notification plan: practical guide for an approvable RS.MA-01 document
The incident management plan is mandatory under NIS 2 Appendix C (RS.MA-01). This guide covers what an approvable plan must include, a practical temp…
NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document
The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa…
NIS 2 Response Controls (RS): Containment and Eradication in Incident Handling
Containment and eradication are iterative response steps that limit damage and remove attacker persistence. Practical guide to strategy selection, ev…
NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document
The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem…
NIS 2 business continuity plan: practical guide to build an approvable ID.IM-04 document
The business continuity plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must include, a practical temp…
NIS 2 vulnerability management plan: practical guide for ID.RA-08 approval
The vulnerability management plan is mandatory under NIS 2 Appendix C (ID.RA-08). This guide covers what an approvable plan must show, a practical st…