Documentation audit
How we review compliance documentation: evidence, consistency between documents, findings and the priority of corrective actions.
All articles
NIS 2 cybersecurity training plan: practical guide for an approvable PR.AT-01 document
The cybersecurity training plan is mandatory under NIS 2 Appendix C (PR.AT-01). This guide covers what an approvable plan must contain, a practical t…
NIS 2 remediation roadmap (Piano di Adeguamento): practical guide for ID.IM-01 approval
The remediation roadmap is mandatory under NIS 2 Appendix C (ID.IM-01). This guide covers how to consolidate gaps, prioritize actions, align mileston…
NIS 2 risk treatment plan: practical guide for ID.RA-06 approval
The risk treatment plan is mandatory under NIS 2 Appendix C (ID.RA-06). This guide covers what an approvable plan must show, a practical structure wi…
NIS 2 risk assessment document for systems and networks: practical guide for ID.RA-05 approval
The risk assessment of information and network systems is mandatory under NIS 2 Appendix C (ID.RA-05). This guide covers what an approvable assessmen…
NIS 2 cybersecurity organization document: how to structure it for GV.RR-02 approval
The cybersecurity organization document is mandatory under NIS 2 Appendix C (GV.RR-02). This guide covers what it must prove, a practical template st…
NIS 2 cybersecurity policies document: practical guide for GV.PO-01 approval
Cybersecurity policies are mandatory under NIS 2 Appendix C (GV.PO-01). This guide covers what an approvable policy package must include, a modular t…
NIS 2 operational templates for GRC teams: what to prepare and why it matters
NIS baseline guidance identifies a concrete documentation set required for governance approval. This guide maps the Appendix C template set, explains…
NIS 2 mandatory documents master guide: what must be approved by the board and what to prepare now
Appendix C lists 11 documents requiring board-level approval under NIS 2 baseline obligations. With incident notification already live and baseline m…
NIS 2 baseline security measures: ACN's 37 and 43 measures and deadlines
ACN Determination 379907/2025 sets the NIS 2 baseline security measures: 37 for important entities and 43 for essential ones, organised into six func…