NIS2 Article 21 Control-by-Control Evidence

The evidence file should show more than the existence of a cybersecurity program. It should show that the entity has identified Article 21 controls, selected measures proportionate to its risks, implemented them for the relevant network and information systems, and kept management oversight visible.

Keep Article 20 governance evidence beside the Article 21 control evidence. Management bodies must approve the cybersecurity risk-management measures, oversee implementation, and receive training, so board or management approval records are part of the evidence trail.

Use the Article 21(2) list as the spine of the evidence matrix. Each row should state the control area, the responsible owner, the implemented measure, the evidence record, the last review date, and the next trigger for review.

| Control area | Owner | Implemented measure | Evidence record | Last review | Next review trigger | | --- | --- | --- | --- | --- | --- | | Governance and risk analysis | CISO / risk owner | Risk methodology, risk register, security policy, and management approval | Approved risk assessment, treatment plan, and board reporting | Latest annual review | Major risk change or annual policy review | | Incident handling | SOC / incident manager | Triage, escalation, response, and lessons learned | Incident handling procedure, incident records, and post-incident reviews | Latest incident exercise | Significant incident or procedure update | | Business continuity and crisis management | BCM lead | Backup, recovery, and crisis roles | BIA, DR plan, recovery test results, and crisis plan | Latest recovery test | Major service change or failed test | | Supply chain security | Procurement / vendor owner | Supplier screening and contract controls | Supplier inventory, risk assessments, clauses, and vulnerability review records | Latest supplier review | New direct supplier or contract renewal | | Secure acquisition, development, maintenance, vulnerability handling, and disclosure | Engineering / product owner | Security requirements, change control, patching, and disclosure handling | SDLC controls, patch logs, vulnerability intake, and disclosure records | Latest release cycle | Major release or critical vulnerability | | Effectiveness assessment | Security assurance lead | Testing and audit program | Test plan, scan results, penetration tests, remediation tracker, and audit outputs | Latest test cycle | New material weakness or scheduled retest | | Cyber hygiene and training | HR / awareness lead | Awareness, training, and secure working practices | Completion records, phishing exercises, and device configuration standards | Latest training campaign | New starter cohort or annual refresh | | Cryptography and encryption | Security architecture lead | Encryption standards and key management | Crypto policy, key management records, exception approvals, and review notes | Latest crypto review | Algorithm change or exception renewal | | Human resources security, access control, and asset management | IAM / asset owner | Joiner-mover-leaver, privileged access, and inventory controls | Access reviews, asset inventory, classification, lifecycle, and end-of-life records | Latest access review | Role change, asset disposal, or access exception | | Multi-factor or continuous authentication and secure communications | Identity / communications owner | MFA coverage and secure channels | MFA enforcement evidence, exception approvals, and secure communication procedures | Latest authentication review | New privileged route, remote access change, or exception expiry |

The second half of Article 21(2) is often where evidence becomes thin. A policy title alone is not enough; the record should show how the control was put into operation and how the entity knows it is working.

For entities covered by Implementing Regulation (EU) 2024/2690, the annexed requirements and ENISA guidance provide additional implementation structure for digital infrastructure, ICT service management, digital provider, and trust-service contexts.

Build one row per Article 21 control area and one additional row for governance. Avoid a single undifferentiated folder called "NIS2 evidence"; it makes gaps hard to spot and does not show whether all ten control areas have been addressed.

For each row, keep the legal source, the internal implementation reference, the control owner, the evidence location, the latest test or approval, and the next review trigger. That structure lets legal, security, procurement, engineering, and management-body reviewers use the same record.

Use this checklist before presenting Article 21 evidence to management, auditors, or a competent authority. It focuses on traceability: every claim should connect to a source, an owner, an implemented measure, and retrievable proof.

Do not treat a framework mapping, supplier certificate, or general security policy as complete Article 21 evidence unless it is tied back to the specific control area and scope it supports.