Assurance in NIS2: what article 21(2)(f) requires

In this lesson

• Read article 21(2)(f) exactly, and say what it requires of every essential and important entity and what it leaves to the entity.
• Separate three layers: the directive, Implementing Regulation (EU) 2024/2690 for the entity types in its article 1, and the methodology of internal audit, which is practice.
• Place internal audit among the other assurance activities of the entity: effectiveness assessment, compliance monitoring, security testing and independent review.
• Tell apart three kinds of audit that an entity in scope will meet: its own internal audits, the audits a competent authority can order, and certification audits.

One measure among ten

Art. 21(2)(f)

Article 21(2) lists the measures that the cybersecurity risk-management measures of every essential and important entity “shall include at least”. Point (f) reads: “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”.

Two words carry the weight. Effectiveness means the question is not whether a measure exists on paper but whether it achieves its purpose against the risks it was chosen for. A backup policy exists; whether a critical system can actually be restored is a question of effectiveness. Policies and procedures means a standing, repeatable process, not a single review commissioned before an inspection. An entity that ran one assessment three years ago has a report, not a procedure.

Point (f) is a measure in its own right, approved and overseen by the management body like every other measure under article 20(1). It is also the measure that tells the management body whether the other nine work. Without it, oversight rests on the word of the people who run the controls.

Like the rest of article 21, point (f) is addressed to Member States, which “shall ensure” that entities take the measures. The obligation reaches the entity through national law. Article 5 allows Member States to adopt or maintain provisions ensuring a higher level of cybersecurity, so the national text may add audit or assessment duties that the directive does not contain. Check the text that applies to you on the transposition tracker.

What the directive does not say

Art. 21(1), 21(4)

Point (f) does not mention internal audit. It does not require an internal audit function, an audit committee, an independent reviewer, a frequency, a sampling method or a professional standard. It does not say who performs the assessment. Recital 89 adds only that entities “should evaluate their own cybersecurity capabilities”.

The how comes from the general test of article 21(1). The measures must be “appropriate and proportionate”, take into account the state of the art and, where applicable, relevant European and international standards, and the cost of implementation. Proportionality takes account of the entity’s exposure to risks, its size, and the likelihood and severity of incidents. A small entity may meet point (f) with a documented self-assessment procedure and an annual external review; a large one with a complex estate may need a dedicated function. Both are choices justified under article 21(1), and a supervisor judges whether they are appropriate.

Two other provisions frame the assessment. Article 20(1) requires the management body to approve the measures and oversee their implementation: it needs information about effectiveness to do so. Article 21(4) requires an entity “that finds that it does not comply with the measures provided for in paragraph 2” to take, “without undue delay, all necessary, appropriate and proportionate corrective measures”. The point (f) procedure is how the entity finds out; article 21(4) says what must happen next.

What Implementing Regulation (EU) 2024/2690 adds

Reg. 2024/2690, art. 1, Annex 2 and 7

Implementing Regulation (EU) 2024/2690 binds only the entity types in its article 1: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. For a hospital, a water utility or a manufacturer, its Annex is a detailed reference, never an obligation.

For the relevant entities, three parts of the Annex concern assurance.

• Point 7, effectiveness. Point 7.1 requires them to “establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken by the relevant entity are effectively implemented and maintained”. Point 7.2 requires the policy to take into account the risk assessment and past significant incidents, and the entity to determine what is monitored and measured, the methods, when, who measures, when the results are analysed and who analyses them. Point 7.3 requires the policy and procedures themselves to be reviewed and, where appropriate, updated at planned intervals and when significant incidents or significant changes to operations or risks occur.
• Point 2.2, compliance monitoring. The entities regularly review compliance with their policies, rules and standards, inform the management bodies through regular reporting, and run a compliance reporting system.
• Point 2.3, independent review. The entities “review independently their approach to managing network and information system security and its implementation including people, processes and technologies”. Reviews are carried out by “individuals with appropriate audit competence”. Staff reviewers “shall not be in the line of authority of the personnel of the area under review”; where the entity’s size does not allow that separation, it must put in place “alternative measures to guarantee the impartiality of the reviews”. Results, including those of compliance monitoring and of point 7, are reported to the management bodies, and corrective actions are taken or residual risk accepted under the entity’s risk acceptance criteria.

Note where the independent review sits. Points 2.2 and 2.3 belong to section 2 of the Annex, which implements point (a) of article 21(2), the policies on risk analysis. Point (f) is implemented by section 7. An entity may file its internal audit under point (f) in its own mapping, which is a reasonable choice; when you cite the Annex, cite the point that actually contains the rule.

Recital 15 links the pieces. It describes security tests, including penetration tests, vulnerability scanning and security audits, carried out “to verify whether the cybersecurity risk-management measures are implemented and function properly”, whose findings should inform the effectiveness procedures and the independent reviews. Recital 27 lists the auditor among the roles entities should consider when assigning responsibilities.

Three layers, side by side

Everything in the last column is the craft of internal audit. Professional standards exist for it, such as the Global Internal Audit Standards of the Institute of Internal Auditors (IIA). They are the profession’s rules and a sound basis for method, but they are not NIS2 requirements, and a supervisor assesses the entity against the law, not against them.

Three kinds of audit

Art. 32(2), 33(2)

Three kinds of audit use similar techniques and answer different questions.

• Internal audit. Commissioned by the entity, for its management body. The criteria are the ones the entity chooses: the law, the Annex where it applies, its own policies, good practice. Its conclusion is advice to the entity.
• Supervisory audits. A power of the competent authority. For essential entities, article 32(2)(b) and (c) provide for “regular and targeted security audits carried out by an independent body or a competent authority” and for ad hoc audits. For important entities, article 33(2)(b) provides for targeted security audits only. The results of a targeted audit go to the authority. Module 4 covers them.
• Certification audits. A certification body assesses a management system against a standard such as ISO/IEC 27001, within the scope the entity defined. A certificate is evidence about that system. It is never, by itself, compliance with NIS2. Lesson 4.3 shows why.

Internal audit feeds the other two. The authority may request “the results of security audits carried out by a qualified auditor and the respective underlying evidence” (article 32(2)(g) and 33(2)(f)). Write every report knowing that it may be read by the supervisor.

What a supervisor will ask

• Show your policies and procedures to assess effectiveness. The approved document, and records that it has been applied.
• Who assesses, and how independent are they? The organisation chart, the reviewer’s reporting line and, for article 1 entities, the alternative measures if separation was not possible.
• What did the last assessment find, and what happened next? The report, the corrective actions under article 21(4) and their status.
• Which parts of your assurance design are legal requirements and which are your choices? Your analysis of article 1 of Implementing Regulation (EU) 2024/2690 and of the national text.

Key points

• Article 21(2)(f) requires policies and procedures to assess the effectiveness of the measures: a standing process about effect, not existence.
• The directive does not require an internal audit function, an independent reviewer or any audit methodology; those are choices justified under article 21(1).
• For article 1 entities only, the Annex adds an effectiveness procedure (point 7), compliance monitoring (2.2) and an independent review by competent, impartial reviewers (2.3).
• Audit universe, sampling, evidence grading, reporting lines and follow-up are internal audit practice; professional standards are not NIS2 law.
• Internal audits, supervisory audits and certification audits answer different questions; a certificate is never compliance.