NIS2: organizing controls, ownership, and evidence

Scope of this guide

The operational route for NIS2-related assets, suppliers, plans, evidence, and cyber monitoring is the Security & Risk Management Suite. The former standalone NIS2 governance pages have no active routes and must not be configured as a parallel register.

ISP Billing supports organization and traceability; it does not determine whether an entity is in scope, provide legal advice, or certify compliance.

Governance before data entry

Management and qualified advisers must define scope, accountable owners, operational custodians, risk and criticality criteria, review frequency, evidence retention, incident escalation, and notification obligations before operators populate the Suite.

Document who approves assets, suppliers, controls, exceptions, overdue work, false positives, exports, and final reports. A complete form without an accountable owner is not governance.

Inventory and classification

Inventory databases, shared files, documentation, continuity and recovery plans, approved software, physical equipment, services, premises, and people where relevant. For each asset record category, criticality, owner, custodian, state, location, supplier, and category-specific safeguards.

Record meaningful dependencies and review criticality whenever architecture, business impact, exposure, or ownership changes. Do not delete an asset merely to hide an unresolved control or incident.

Suppliers and the supply chain

Classify each material supplier by service category and CPV, access level, operational impact, replaceability, criticality, single-point-of-failure condition, review date, and outcome. Link it to the authoritative CRM supplier.

Prioritize providers with privileged access, critical impact, difficult substitution, or concentrated dependency. Reassess after contract, service, ownership, incident, or regulatory changes.

Plans and recurring controls

Create a control plan for the relevant asset with accountable assignee, execution team, start date, one-time or recurring frequency, next due date, and state. Build an ordered checklist whose mandatory items describe a measurable criterion and expected evidence.

Avoid vague items such as “check security.” State what is inspected, how success is decided, what artifact proves it, and what happens when the result is nonconforming.

Execution and evidence

From Schedule, take the occurrence in charge, complete each checklist item with date and note, attach only necessary authorized evidence, and record the overall outcome. Overdue or incomplete controls remain visible and require management rather than formal closure.

Evidence must let a reviewer understand who performed the work, when, on which asset, using which criterion, with what result, and which corrective action followed. Apply confidentiality and retention rules to every attachment.

Cyber monitoring

The Cyber area integrates Wazuh agents, alerts, vulnerabilities, compliance data, file-integrity events, and authentication logs. Alerts can be taken in charge, worked, closed, or marked false positive while preserving status and timing.

Dashboards and synchronization do not replace triage or incident response. Define severity thresholds, recipients, ownership, response times, ticket or incident linkage, escalation, and notification assessment.

Governance checklist

• Approve legal and operational scope
• Assign accountable owners and custodians
• Define criticality and risk criteria
• Inventory assets and dependencies
• Classify supply-chain exposure
• Create measurable recurring controls
• Assign teams and deadlines
• Preserve relevant protected evidence
• Manage overdue and nonconforming work
• Connect cyber alerts to incident response
• Review inventory, suppliers, and plans
• Audit permissions and exports periodically