NIS 2 in 2026: the document preparation guide for CISOs (what the auditor will look for)

In short.
Preparing for NIS 2 is less about new tools than about documentation you can find. The auditor does not only check that the policy exists: they ask for evidence that it is applied. A documentation checklist separates what must be written down from what must be demonstrated.

The NIS 2 auditor is not going to assess your actual level of security. They are going to assess your ability to demonstrate it.

It is a fundamental distinction that many CISOs still underestimate. An organisation with solid security maturity but scattered, incomplete or outdated documentation risks coming out of an audit with as many findings as a structurally less advanced organisation that is better documented.

In 2026, NIS 2 is fully applicable. The first formal notices are being issued. Essential and important entities that have not structured their document preparation are finding out at the worst possible moment: when the auditor opens their questionnaire.

This guide tells you precisely what they are looking for, and how to be ready.

What NIS 2 really requires in terms of documentation

The NIS 2 directive is built around ten areas of cybersecurity risk-management measures (Article 21). For each of them, the competent national authorities can ask for documentary evidence of implementation.

Here are the areas most frequently audited and what the auditor concretely expects in each.

1. Information systems security policy

What the auditor looks for:

• A formal information security policy, approved by management, dated and versioned
• Evidence that it has been circulated to all relevant staff
• The date of the last review (NIS 2 requires regular review)
• A documented update process

The common trap: a policy that exists but has not been updated since 2022, or a policy approved by the CISO but never presented to the executive committee. NIS 2 requires commitment from management: not just from the security team.

2. Risk management

What the auditor looks for:

• A formal risk analysis, with a documented methodology (EBIOS RM, ISO 27005 or equivalent)
• An up-to-date risk register, with criticality levels, owners and treatment plans
• Evidence that the risk analysis feeds security decisions (links between risks and measures)
• A risk review schedule

The common trap: a risk analysis carried out once for ISO 27001 certification and never updated since. The NIS 2 auditor checks how current the approach is: not just that it exists.

3. Security incident management

What the auditor looks for:

• A documented procedure for detecting, qualifying and notifying incidents
• The criteria for qualifying a significant incident (according to the NIS 2 threshold: significant disruption of services)
• The procedure for notifying ANSSI, the French national cybersecurity agency, within 24h (early warning) and 72h (initial notification)
• Evidence of incident management tests or exercises
• The register of incidents handled (even minor ones)

The common trap: a well-documented internal escalation procedure, but no formal external notification procedure. NIS 2 adds an obligation to notify the regulator that few organisations had before.

4. Business continuity and crisis management

What the auditor looks for:

• A formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)
• RTOs and RPOs defined for critical services
• Evidence of a BCP test within the last 12 months
• A map of critical dependencies (cloud, suppliers, systems)

The common trap: a theoretical BCP that has never been tested. The auditor will systematically ask for the report of the last exercise. If there is none, that is a major finding.

5. Supply chain security

What the auditor looks for:

• A documented supplier security policy
• A process for assessing the security of critical suppliers
• Security clauses in your key supplier contracts
• A list of critical suppliers with their assessment level

The common trap: this is the least prepared area in most organisations. Contractual security clauses are often missing or too generic. NIS2 is explicit on this point, and it is one of the first questions asked during an audit.

6. Human resources security

What the auditor looks for:

• A secure onboarding and offboarding procedure (documented access revocation)
• Evidence of staff training and awareness (dates, content, coverage rate)
• A policy for managing authorisations and access rights

7. Access control and identity management (IAM)

What the auditor looks for:

• A documented access management policy (principle of least privilege)
• Privileged account management (PAM) with logging
• Multi-factor authentication on critical systems
• A documented periodic review of access rights

8. Cryptography and encryption

What the auditor looks for:

• A documented cryptography policy (approved algorithms, key management)
• Evidence that sensitive data is encrypted in transit and at rest
• A certificate renewal process

The NIS 2 document preparation checklist

📎 This checklist is designed for self-assessment before an audit. For each item, mark: ✅ Available and up to date | ⚠️ Exists but needs updating | ❌ Missing

BLOCK A, Governance and policy

• [ ] Formal information security policy, dated, versioned
• [ ] Documented approval by general management
• [ ] Evidence of circulation to staff (email, intranet, training)
• [ ] Date of last review (under 12 months)
• [ ] Documented review process
• [ ] Organisation chart of the security function with roles and responsibilities
• [ ] NIS2 commitment formalised at executive committee level or equivalent

BLOCK B, Risk management

• [ ] Documented risk analysis methodology
• [ ] Up-to-date risk analysis (under 12 months or following a major change)
• [ ] Risk register with owners and deadlines
• [ ] Documented treatment plans for critical risks
• [ ] Traceable link between risks and security measures
• [ ] Risk review schedule

BLOCK C, Incident management

• [ ] Incident detection and qualification procedure
• [ ] Criteria for qualifying a significant NIS2 incident
• [ ] ANSSI notification procedure (24h / 72h / final report)
• [ ] ANSSI and CERT-FR contacts documented and up to date
• [ ] Incident register (last 12 months minimum)
• [ ] Report of the last incident management exercise

BLOCK D, Business continuity

• [ ] Formal BCP with RTO and RPO per critical service
• [ ] Formal DRP
• [ ] Map of critical dependencies (cloud, suppliers, systems)
• [ ] Report of the last BCP test (under 12 months)
• [ ] Crisis communication procedure

BLOCK E, Supply chain security

• [ ] Documented supplier security policy
• [ ] List of critical suppliers with assessed criticality
• [ ] Security assessment process for critical suppliers
• [ ] Security clauses in key supplier contracts
• [ ] Security questionnaires sent and archived (supplier responses)

BLOCK F, Human resources and training

• [ ] Documented secure onboarding procedure
• [ ] Offboarding procedure with access revocation
• [ ] Training and awareness register (dates, content, people)
• [ ] Awareness coverage rate (NIS2 target: all staff)

BLOCK G, Access control (IAM)

• [ ] Documented access management policy
• [ ] Least-privilege policy applied and documented
• [ ] Privileged account management (PAM) with logging
• [ ] MFA deployed on critical systems (evidence of deployment)
• [ ] Access rights review (under 6 months)

BLOCK H, Cryptography

• [ ] Documented cryptography policy
• [ ] Certificate inventory with expiry dates
• [ ] Certificate renewal process
• [ ] Encryption of sensitive data in transit and at rest documented

What the auditor does with your documents

Understanding how a NIS 2 audit unfolds lets you anticipate precisely what will be asked for.

Phase 1, Pre-audit questionnaire. Before the on-site audit, you will receive a structured maturity questionnaire. It is your first opportunity to demonstrate how rigorously you have prepared, and the first opportunity to reveal documentation gaps that the auditor will then dig into.

Phase 2: Document review. The auditor asks to see the documents listed in your questionnaire. They check that what you declared is consistent with what you produce. They check update dates, approval signatures and versions. A policy not approved by management or a BCP that has never been tested will be flagged immediately.

Phase 3: Interviews. The auditor meets the CISO, the CIO and sometimes the CEO. They ask about concrete cases: “Describe the last significant incident you handled.” “How did you assess the security of your main cloud provider?” The answers must be consistent with the documents produced.

Phase 4, Technical tests. For some scopes, the auditor may ask for technical demonstrations: configuration review, test of the notification procedure, verification of MFA deployment.

The three most common documentation mistakes

Mistake 1: documents that exist but that nobody can find. The security policy is in SharePoint, in the folder Security › Policies › Archives › 2024. The auditor asks to see the version in force. It takes 20 minutes to find it. That sends a negative signal about the maturity of your document organisation.

Mistake 2: approval dates that reveal the absence of review. A document approved in 2021 and never updated since will systematically be questioned. The NIS 2 auditor does not only ask whether the document exists: they ask when it was last reviewed, and what has changed since.

Mistake 3: documents that are inconsistent with each other. The access management policy states that rights reviews are quarterly. The review register shows the last one was 11 months ago. This kind of inconsistency between the stated policy and evidence of implementation is the most common finding, and the easiest to avoid.

How to prepare the document collection without paralysing your team

NIS 2 document preparation represents between 3 and 6 weeks of work for a team of 2 to 3 people in a mid-sized organisation. That time can be considerably reduced if the existing document base is accessible and searchable.

Optivalue.ai lets you centralise your entire security document base (policies, certifications, audit reports, procedures, meeting reports) and answer NIS 2 audit questionnaires by drawing directly on your own documents, with the exact source (document, page, date) for each answer.

In practice: when the auditor’s pre-audit questionnaire arrives, each question is handled by automatically drawing on the relevant documents in your base. Your team reviews, adjusts and approves. The time needed to produce the answers drops from several days to a few hours.

Jérôme Emin, CISO at Sully Group, used this approach to prepare the renewal of the company’s ISO 27001 certification: “Building the evidence file, which usually took us a week, was reduced to a day. Every answer was sourced from our own documents: the auditor had no questions about where the information came from.”

Where to start this week

If your NIS 2 audit is 3 to 6 months away, here are the three actions to prioritise immediately.

Action 1: Map your documentation gaps. Use the checklist above to identify the blocks where you are at ⚠️ or ❌. Focus your efforts first on blocks A (governance), C (incidents) and E (supply chain): these are the three areas most often found non-compliant in the first NIS 2 audits.

Action 2: Check all your approval dates. Go through each key document and identify those whose last approval date is more than 12 months old. Schedule a review and a re-approval (even a formal one) before the audit.

Action 3: Build your evidence file. Every NIS 2 area must be demonstrable through documentary evidence. Start gathering that evidence now, in a file structured by area: not in the week before the audit.

Optivalue.ai lets you answer NIS 2 questionnaires by drawing directly on your existing document base. Dedicated private instance, hosting in France, answers sourced document by document. Request a personalised demonstration →