Which proof you need to demonstrate the NIS2 measures, and how Nispo collects it and links it to controls.
Key facts
- Evidence is proof that a requirement is implemented: a check result, an approved document, an inventory, a register, a report.
- ACN requires documentation that reflects the current state, is updated whenever something changes and is “easily accessible”.
- In Nispo every piece of evidence is linked to its control, with date, source and owner. Data is stored in the European Union (Microsoft Azure, West Europe region).
What counts as evidence
| Type | Example | How it gets into Nispo |
|---|---|---|
| Automated check | MFA enabled on all admins | From the integrated systems |
| Approved document | Access control policy | Template, adaptation, approval |
| Inventory or register | Devices and software, policy reviews, training | Import from the integrated systems or manual entry |
| Third-party reports and documents | Penetration test and retest; supplier questionnaires and DPAs | Upload, Nispo services, supplier module |
| Exports from non-connected systems | Backup restore tests, firewall rules | Upload with a description |
What ACN asks for
ACN’s FAQ list what to produce: lists (staff, configurations, remote access), inventories (devices, services, software), plans (risk, business continuity, vulnerabilities, training), policies, procedures and registers. They must reflect the current state, be updated whenever something changes and be easily accessible: screenshots scattered across inboxes and shared folders rarely are.
How Nispo handles it
- Linked to controls: you see at once which requirements have no proof.
- With date, source and owner, and reused for controls, risks and reports.
- Versioned for documents, with reminders for contracts, DPAs, certifications and questionnaires.
- Exportable to PDF and CSV.
- Stored in the EU, with role-based access; the Microsoft 365 connection is read-only.
Evidence proves a fact on a date, not that the measure is adequate: that is why checks are repeated and documents have a review status.