NIS2 compliance evidence: what to keep if supervisors move from guidance to inspections

What changes when NIS2 supervision moves from guidance to verification

Once baseline deadlines pass, supervisors can test what you implemented in addition to supporting you.

As baseline deadlines expire, existing verification powers become fully usable. This is our reading, not an ACN announcement. Directive (EU) 2022/2555 already gives authorities inspections, audits and requests for evidence (Article 32), and in Italy, according to the ACN NIS Vademecum of September 2026, entities listed in 2025 must have baseline measures in place by October 2026.

ACN has not announced an inspection campaign. The point is timing: existing powers become fully usable once the obligations they check fall due.

Italy as an example of a national authority reaching its deadline

When ACN began notifying entities in April 2025, its list counted over 20,000 organizations, more than 5,000 of them essential. Under the Vademecum, entities listed in 2025 have reported significant incidents since January 2026.

On September 18, 2026, ACN opened a consultation on reinforced security measures meant to supplement and replace the baseline ones. ACN describes supervision as gradual and risk-based, but a gradual approach does not mean the powers go unused.

What supervisors can already do under Articles 32 and 33

Article 32 of the Directive covers essential entities: on-site and remote inspections with random checks, regular, targeted and ad hoc audits, security scans, requests for information and documents, and requests for evidence of implemented cybersecurity policies. None of it needs a prior incident.

Article 33 covers important entities, and supervision there is ex post: the authority acts on evidence, indications or information of possible non-compliance. By then, what the entity can show is whatever it recorded beforehand.

Why inspections test proof, not declarations

An inspector weighs a document by whether its date and integrity can be shown, whatever it looks like.

A piece of NIS2 compliance evidence proves a measure when you can show when it was produced and that it hasn’t changed since. The same idea underlies ISO/IEC 27037, the international guidelines for identifying, collecting, acquiring and preserving digital evidence: a documented acquisition method, then integrity preserved from that moment on.

The stakes are personal: under Article 20, management bodies approve the risk-management measures, oversee them and can be held liable for infringements.

Where screenshots, exported logs and unsigned minutes fall short

A screenshot takes its date from the device clock, can be edited and doesn’t show whether the page was live. An exported log is usually a CSV that anyone with access can change, and the export date says nothing about when the events happened. Minutes in a word-processing file change metadata at every save.

Each file may be accurate, but nothing in it lets a third party check, so the inspector has to take your word.

Which NIS2 compliance evidence to keep for each area

Each area of NIS2 has a natural moment of capture: when the decision is taken, when the measure goes live, while the incident is happening.

NIS2 compliance evidence falls into four families mapped to the Directive: governance (Article 20), cybersecurity risk-management measures (Article 21), incident reporting (Article 23) and supply chain security (Article 21(2)(d)). Each needs records whose date and integrity can be verified.

Governance and policies

Keep the resolution approving the measures, every revision and proof that board members followed the training Article 20 requires. A certified copy shows the document existed in that form on that day.

Technical measures: configurations, MFA, backups and vulnerability handling

Article 21(2) sets a minimum list that includes backup management, vulnerability handling, access control, cryptography and multi-factor authentication. These NIS2 Article 21 measures are easy to check against a live system. The ENISA Threat Landscape 2025, based on 4,875 incidents between July 2024 and June 2025, found phishing behind around 60% of initial intrusions and vulnerability exploitation behind 21.3%. MFA and patching target those entry points, so capture the console showing each setting on the day it took effect.

Incidents: timeline and reports

Article 23 sets the sequence: early warning within 24 hours, incident notification within 72 hours, final report within one month of the notification. You need to prove what you saw and when, and that each report left on time. Record affected systems while the incident is visible and keep each report as sent.

Suppliers and the supply chain

Article 21(2)(d) brings supply chain security into scope, including relationships with direct suppliers. Gather scattered supplier evidence into one file per supplier, with a data audit trail showing when each attestation arrived and in what form.

How to build an evidence file before the inspector asks

A defensible file of NIS2 compliance evidence is built as you go, one folder per measure, incident and supplier, each item dated at capture.

An evidence file for NIS2 is a set of records, each tied to an obligation, captured when the underlying fact happened and stored so its integrity can be checked without trusting whoever hands it over.

1. 1

   Map each measure to its evidence

   List every measure adopted under Article 21 and the NIS2 compliance evidence that proves it: a configuration page, a signed resolution, a backup report. Add an owner and the event that triggers a capture.

2. 2

   Capture evidence when the measure goes live

   Capture the live system with a forensic method on the day MFA is enforced, a backup policy starts or a vulnerability is patched. Repeat at every material change so the file shows history.

3. 3

   Document incidents while they unfold

   Start recording when an incident is declared, capture the dashboards and alerts, and certify each report as it goes out. Article 23 starts the clock when you become aware of a significant incident, and a timeline built in real time holds up better than one rebuilt from memory.

4. 4

   Store the file so a third party can verify it

   Keep the originals alongside their integrity data: hashes, seal and timestamp. A reviewer should be able to confirm independently that nothing changed, which is the logic of a digital chain of custody from capture to presentation.

How can TrueScreen make the date and integrity of NIS2 compliance evidence verifiable?

TrueScreen certifies evidence when it is collected, so anyone can check its date and integrity later.

TrueScreen, the Data Authenticity Platform, supports NIS2 integrity and traceability obligations with certified data. It acquires consoles, web pages, screens and photos with a forensic methodology that follows ISO/IEC 27037 guidelines, certifies existing files from the moment of certification, and every certification carries a qualified electronic seal and a qualified timestamp, qualified under eIDAS. The acquisition process is designed to prevent tampering, and later alterations are detectable.

Consoles and web pages: Forensic Browser and Browser Extension

The Forensic Browser is a desktop application for macOS and Windows suited to admin consoles, SaaS dashboards and supplier portals. Its package records the page, the network traffic where captured and a clock check, with the fingerprint of every file. Files downloaded in the same session are certified too. For quicker captures, use the Browser Extension for Chrome and Edge. More on web page certification with legal value.

Screens, files and site photos: Portal and TrueScreen App

For business applications and desktop clients, use screen recording in the Portal on a computer, or the TrueScreen App on phones. A certified screen recording of a restore test keeps the sequence intact. Policies, board resolutions, registers and exported logs can be certified as files in the Portal or the App, dated from the moment of certification rather than file creation. For site inspections, the App captures photos live, with time, and location when the flow requires it.

Suppliers and third-party verification: TrueFlow and the public verifier

TrueFlow guides a third party, such as a supplier, through a certified acquisition from a link, even without an account if the TrueFlow does not require a login. Each package contains the report and the original files. The public verifier recalculates SHA-256 hashes in the browser without uploading anything, while validating the certificate against EU trust lists is done separately with the European Commission’s DSS validator. Under eIDAS, the qualified electronic seal is defined in Article 3(27) and the qualified timestamp in Article 3(34).

An example: proving when MFA went live

A security team enforces MFA on administrator accounts. That day, the CISO acquires the identity provider’s console with the Forensic Browser and files the sealed package as NIS2 compliance evidence for that measure. A year later, the package shows MFA was active that day and the evidence hasn’t changed. A certified configuration proves how and when it was captured, not that the measure is adequate or compliant: that judgment stays with you and your supervisor. Certification does not replace legally compliant long-term preservation or the incident notification to the authority, which remain the entity’s responsibility.

Conclusion