Understanding How External NIS2 Auditors Search for Evidence for Paragraphs 11.2.3 and 11.2.4 of the CATS NIS Implementation Guide
How AcmeCorp Revolutionized Compliance with CATS and AI Integration
AcmeCorp, a mid-sized tech firm navigating the stringent requirements of the NIS2 Directive, faced a daunting challenge: managing compliance across internal operations while ensuring that their business-critical suppliers met the same standards. The stakes were high—cybersecurity risks and potential regulatory fines loomed over every decision.
To address these challenges, AcmeCorp adopted the CATS (Cybersecurity Assessment and Tracking System) framework. The solution offered an intuitive self-assessment survey tool, enabling employees across departments to identify gaps in compliance and streamline the creation of company-wide policies. The automated surveys generated detailed reports, which formed the foundation for new access control and supply chain policies aligned with NIS2 requirements.
But AcmeCorp didn’t stop there. They integrated an embedded Supply Chain Risk Management (SCRM) tool into the CATS platform. The SCRM tool sent tailored questionnaires directly to their business-critical suppliers, focusing on NIS2-aligned criteria like access control, incident response, and third-party risk. Suppliers’ responses were automatically analyzed, and flagged risks were escalated for immediate action. This proactive approach enabled AcmeCorp to hold suppliers accountable while mitigating supply chain vulnerabilities.
To further enhance decision-making, AcmeCorp deployed CATS-GPT, an AI-driven assistant embedded within the CATS platform. CATS-GPT provided real-time insights by analyzing self-assessment data, supplier responses, and regulatory requirements. It offered tailored recommendations, such as refining access control policies or prioritizing high-risk suppliers for follow-up audits.
With this integrated system, AcmeCorp transformed a compliance burden into a strategic advantage. The streamlined workflows not only ensured NIS2 compliance but also improved cybersecurity resilience and strengthened supplier relationships—positioning AcmeCorp as a leader in secure and responsible business practices.
The European Union’s NIS2 Directive emphasizes the importance of robust access control and management. To ensure compliance, external auditors assess relevant entities based on specific requirements, such as those outlined in Paragraphs 11.2.3 and 11.2.4 of the ENISA NIS2 Implementation Guide. Below is a simplified overview of how auditors search for evidence, their approach, and the relevant frameworks mapped to these requirements.
Overview of Paragraphs 11.2.3 and 11.2.4 Requirements
11.2.3 – Regular Review of Access Rights
Relevant entities must:
- Regularly review and update user access rights to ensure alignment with organizational changes.
- Document the results of these reviews, including changes made to access rights.
11.2.4 – Centralized Access Control and Mapped Frameworks
Entities are encouraged to centralize access control using tools such as a directory service or Single Sign-On (SSO) solutions to enhance management and compliance. These practices align with international standards, such as ISO 27001:2022 and NIST CSF v2.0.
Key Evidence Sought by Auditors
Auditors focus on gathering both procedural and technical evidence to confirm compliance. Below are examples of the evidence typically assessed for these paragraphs:
For Paragraph 11.2.3: Access Rights Review
- Centralized Records of Access Rights
- Evidence includes registers or databases with details of all user access rights, roles, and permissions.
- Approved Access Change Requests
- Documentation of access requests approved by asset owners and management.
- Logs and Audit Trails
- Logs showing the creation, modification, and deletion of access rights, with timestamps and user IDs.
- Periodic Access Review Evidence
- Proof of regular reviews (e.g., annual or semi-annual) of access rights, including reports documenting findings and corrective actions.
- Incident Records
- Documentation of incidents related to unauthorized access, with corrective measures outlined.
- Internal and External Audit Reports
- Reports verifying compliance with access control policies and highlighting gaps.
For Paragraph 11.2.4: Centralized Access Control
- Centralized Directory Services or SSO Solutions
- Evidence of tools like Active Directory or SSO services managing access control across the organization.
- System Documentation
- Manuals and process documentation outlining centralized access control mechanisms.
- System Logs
- Logs showing centralized authentication and authorization processes.
- Integration Reports
- Reports demonstrating how centralized access systems align with organizational policies and frameworks.
Practical Tips for Entities
- Centralize Access Control
- Use a directory service or SSO provider to simplify and standardize access management.
- Automate Access Reviews
- Leverage Identity and Access Management (IAM) solutions to automate access reviews and logging.
- Maintain an Up-to-Date Access Register
- Ensure all access changes are recorded promptly in a centralized database.
- Perform Regular Audits
- Schedule periodic internal and external audits to identify and address compliance gaps.
- Address Third-Party Access
- Regularly review and restrict access granted to suppliers, contractors, and other third parties.
Mapped Frameworks
Auditors evaluate compliance by referencing international and regional frameworks mapped to these requirements. Key frameworks include:
- ISO 27001:2022
-
- A.5.18: Access control principles.
- A.9: Access control policies and procedures.
- NIST CSF v2.0
-
- PR.AA-05: Access management practices.
- ID.IM-01 to ID.IM-04: Identity management and access control policies.
- BE-CyFun®2023
-
- Basic Controls: Foundational access management requirements.
- Important and Essential Controls: Advanced measures, such as access control integration with cybersecurity functions.
Conclusion
External auditors play a critical role in ensuring compliance with the NIS2 Directive. By focusing on evidence-based assessments for Paragraphs 11.2.3 and 11.2.4, auditors help entities align their practices with best-in-class frameworks like ISO 27001 and NIST CSF. Entities can prepare by centralizing access control, maintaining comprehensive access registers, and performing regular reviews and audits. These practices not only meet regulatory requirements but also strengthen overall cybersecurity resilience.
