Quick summary
- Essential entities can be audited at any time – even without an incident
- Important entities are only audited after incidents (ex-post)
- You should prepare internally, document decisions, and assign responsibilities
- Presenting your critical services, asset protection measures, and management involvement builds credibility
- The audit outcome will depend on your preparedness: follow the tips below to ensure it’s successful
Who can expect a NIS2 compliance audit?
If your organization falls within the scope of the NIS2 Directive, you should prepare for the possibility of being visited by the authorities.
If you are an essential entity, you will be subject to regularly scheduled inspections planned randomly, regardless of whether an incident has occurred. You will typically receive a letter from the competent authority about two weeks before the scheduled audit date informing you of the upcoming inspection (and perhaps the specific subject areas they will investigate).
If you are an important entity, you will only be inspected ex-post—i.e., after an incident has occurred.
Regardless of whether your organization qualifies as an essential or important entity, you can take some relevant actions to prepare for the inspection and support its positive outcome.
This blog post will give you recommendations on how to approach a compliance audit – before, during, and after the inspection date.
How can you prepare for a NIS2 audit?
Before the inspection
- First, you should inform management and the relevant internal business units of the upcoming audit and its nature, scope, and date.
- Then, you should form a team of those who will be responsible for preparing for and participating in this cybersecurity audit.
- These people should be appropriately trained to be aware of their role in this upcoming inspection.
Moreover, you might want to ensure the availability of additional subject matter experts on the inspection date so that you can involve them should the competent authority wish to discuss their specific areas of responsibility in more detail. - Finally, perform a gap analysis by reviewing your documents and looking for possible deficiencies.
If you identify areas that need improvement, take the necessary steps to address them. If it’s not feasible to fully correct such deficiencies before the inspection date, prepare descriptive documentation of the issues you encountered and the actions you have taken to address them.
During the inspection
- On the date of the inspection, it’s advisable to agree upfront on the duration of the audit, its scope, and the agenda for the day to ensure alignment and agreement on how to proceed.
- Prepare a short and concise presentation to introduce your company and the nature of your business to the competent authority.
That’s the first step in helping them understand whether the cybersecurity measures you implemented are appropriate and proportionate to your organization – and, ultimately, whether you are meeting the NIS2 Directive requirements or not.
The presentation should show that you have identified
– the services critical to society that you provide,
– the assets needed to provide them,
– the measures implemented to protect them,
– the vendors you rely on for the provision of your services,
– the customer segments using your services, and
– the delivery channels through which you provide them.
To help you do that successfully, our Compliance Manager at Secomea prepared a template including all these elements. You can download it here and update it with your company information. If you present the competent authorities with such an overview, you’ll be up to a great start and give a positive first impression. Besides using it as part of your compliance documentation in case of an inspection, you could also rely on it as an excellent instrument to kick off your internal NIS2 compliance project. - Make sure to have at hand all of the documentation you have prepared to present during the audit.
This documentation should show how you assess risks, detect threats, protect assets, and respond to incidents – as well as prove the involvement of C-level management in all of your decisions.
If you have chosen an international security framework to adhere to, provide documentation on it. That represents a structured approach to working with security and is a good way to show progress.
If your gap analysis revealed deficiencies, provide documentation about their identification and your plan to address them.
After the inspection
The inspection outcome will vary depending on your preparedness and NIS2 compliance level.
When exercising their enforcement powers, competent authorities will consider the particular circumstances of each case, such as the nature, gravity, and duration of the infringement, the damage caused or losses incurred, and the intentional or negligent character of the infringement.
Authorities’ findings | Consequences |
There is no trace of NIS2 being known within your organization: You have completely ignored the enforcement of the NIS2 Directive. | You will likely be issued heavy fines. |
You have done the bare minimum: You may have implemented only a few cybersecurity measures, but your overall risk assessment and risk management strategy still fall short of achieving full NIS2 compliance. | You will probably be issued fines proportionate to your infringements and given a deadline to implement the necessary improvements. |
You have tried to achieve compliance to the best of your ability, but deficiencies have been uncovered. | The authorities will likely not issue a fine but engage in a dialogue with you to instruct you on the areas needing improvement, and they will establish a deadline for you to implement such improvements. If that happens, ensure that the required measures are put in place within the set deadline to avoid fines. |
You have followed all the necessary steps and implemented best practices | If the authorities assess that you are following industry standards and thoroughly fulfilling the NIS2 objectives and requirements, the audit will be successful. |
Need help preparing?
To support you in achieving full compliance, we have compiled this whitepaper covering everything you need to know about the new cybersecurity legislation.
Download your copy to:
- Learn what the NIS2 Directive is and why it was needed
- Understand if you fall into the scope of the Directive and whether your organization is considered an essential or important entity
- Familiarize yourself with the requirements you need to comply with
- Discover how you can achieve full NIS2 compliance through 10 steps
- Get support in fulfilling your NIS2 obligations by using Secomea to improve your cybersecurity
All you need to know to ensure NIS2 compliance
Get the PDF now!
When will the authorities come audit my organization’s NIS2 compliance?
That depends on the deadline set by your country’s specific legislation.
While the NIS2 Directive set a clear deadline of 17 October 2024 for national transposition, implementation progress has varied significantly across the EU and EEA.
If you want to check whether your country has already completed the NIS2 transposition into local law, you can do that through the whitepaper below, which offers a practical, country-by-country overview of where things stand as of mid-2025.
NIS2 implementation progress across Europe
Download it now for free!
Frequently asked questions (FAQ)
Who gets audited under the NIS2 Directive?
Essential entities can be proactively audited at any time. Important entities are audited only after incidents or signs of non-compliance.
How do I prepare for a NIS2 compliance audit?
Assemble an internal team, review documentation, fix gaps, and prepare a clear overview of your cybersecurity approach and risk controls.
What should you do before the inspection?
Start by:
Notifying executive leadership and affected departments
Assembling a dedicated internal team to manage the audit process
Ensuring team members understand their roles and audit expectations
Identifying and involving subject matter experts (SMEs) to be available on the audit date
Next, conduct a gap analysis:
Review your documentation, risk assessments, and technical measures
Identify any deficiencies and either resolve them or prepare written explanations of your plan to do so
If national authorities send a pre-audit letter (common for essential entities), review it carefully to understand the focus areas and scope.
What should you do during the audit?
Agree on:
The duration and scope of the inspection
The agenda for the day
Then, deliver a clear, concise overview presentation of your organization, including:
The critical services you provide
Key assets and vendors you rely on
Security measures in place to protect them
Your risk-based approach to compliance
How leadership is involved in cybersecurity strategy
Tip: Download Secomea’s audit preparation template to help structure your presentation.
Have all supporting documentation ready, including:
Risk assessments
Incident response and business continuity plans
Evidence of management oversight
References to any international frameworks (e.g. ISO 27001, IEC 62443) you follow
Notes on any gaps and your plan to address them
What should I present during the inspection?
Show critical services, risk assessments, protective measures, management involvement, and any supporting standards or frameworks.
What should you do after an audit?
The results will depend on how well you’ve prepared and the maturity of your compliance program.
Authorities will also consider:
The severity and duration of any issues
Whether the gaps were intentional or due to oversight
The damage caused (if any)
If given a remediation deadline – meet it. Authorities may follow up to verify that corrections were made.
What happens if I’m not fully compliant?
Authorities may issue fines, request remediation plans, or follow up later. Good-faith efforts with documentation can reduce penalties.
What are the consequences of non-compliance for management?
If competent authorities find compliance failures, they can:
Temporarily suspend certifications
Temporarily remove the CEO or legal representative from their role
Hold senior managers personally liable
Cybersecurity isn’t just IT’s responsibility – it’s a leadership issue.
Can executives be held liable under NIS2?
Yes. CEOs and managers can be suspended or held personally responsible if they fail to ensure NIS2 compliance.
Do the NIS2 audits deadlines vary in the different EU/EEA countries?
Some countries have introduced stricter requirements, such as mandatory internal or third-party cybersecurity audits on a regular basis (e.g., Poland requires biennial audits, Belgium introduced ISO-aligned self-assessments).
Have a look at our whitepaper to learn more about local peculiarities and what the NIS2 rules look like in your country.
