# NIS2: scope first, evidence second

Original SecNet workpaper · 1.0 · 11 October 2026

Complete placeholders for your assessment. The example below is fictional; it is not an executed test or a legal decision.

## Assessment identity

- Record ID: [___]
- Objective and decision question: [___]
- Scope / exclusions: [___]
- Criteria and version: [___]
- Authorization and limits: [___]
- Owner / independent reviewer: [___]
- Period / artifact digest: [___]
- Evidence access / retention: [___]

## Planned procedure

1. Identify legal entities, services, sectors, establishment and size; check exceptions and the national competent authority with qualified local advice. Keep scope assumptions dated.
2. Assign management oversight, accountable control owners and training records. Put unresolved scope questions on the decision register rather than assuming every supplier is directly in scope.
3. Map service dependencies, incident handling, continuity, supply-chain assurance and control effectiveness to existing evidence. Record gaps with owners and due dates.
4. Design an incident decision log: awareness time, significance assessment, reporting authority and message owner. Check applicable sector-specific implementing rules and national procedures.
5. For significant incidents, Article 23 generally sets early warning within 24 hours, notification within 72 hours and a final report within one month of notification. Trust services and ongoing incidents have specific provisions; confirm the applicable path.
6. Run a tabletop using incomplete information, out-of-hours contacts and supplier dependencies. Review evidence, board decisions and notification readiness after the exercise.

## Evidence and decision register

| ID | Criterion | Observation | Redacted evidence / origin / time | Conclusion and limitation | Owner / date | Recheck |
|---|---|---|---|---|---|---|
| [___] | [___] | [___] | [___] | [___] | [___] | [___] |

## Topic-specific deliverables

- [ ] Applicability memo with national sources and unresolved questions.
- [ ] Risk/control gap assessment and management action plan.
- [ ] Incident-notification tabletop report and decision timeline.

## Worked fictional decision example

Fictional logistics provider: a supplier outage interrupts a critical service. The team records when it became aware, evaluates significance under the applicable rules and assigns a notification owner. A preliminary message can distinguish known facts from uncertainty; the exercise measures decision delay without asserting that every outage triggers the same legal duty.

## Closure check

- [ ] National scope and authority checked?
- [ ] Awareness and significance decisions timestamped?
- [ ] Management owns evidence-backed corrective actions?

## Official references · checked: 2026-10-11

- [NIS2 · Directive (EU) 2022/2555 · Articles 20–23](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng)