· Yair Knijn
Turning NIS2 Article 21 into audit records
NIS2 Article 21 reads like a checklist, and that is the problem. Ten categories of risk-management measures, each phrased broadly enough that two auditors will ask for different records. The work is not understanding the article. The work is producing audit records that a specific measure was in place on a specific date, without spending the week before the audit screenshotting portals.
Here is how to map the ten measures to records you can pull on demand.
The ten measures, and the records that satisfy them
Article 21(2) lists policies on risk analysis, incident handling, business continuity, supply-chain security, secure acquisition and development, effectiveness measurement, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication.
Most of these resolve to data your Microsoft tenant already holds. Access control and MFA are Entra ID configuration plus sign-in logs. Cryptography is your key and certificate state. Incident handling is your ticket and alert history. The gap is not the data. The gap is that the data lives in six consoles, each with its own export format and retention window.
One way to close the gap, with your own tooling, is to read those sources on a schedule and save each result with its timestamp somewhere you control and do not edit. When the audit comes, you pull the records for the period: the control, the source it came from, and the value on that date.
Why "on that date" matters more than "today"
An auditor rarely asks whether MFA is enforced now. They ask whether it was enforced across the period under review, and what happened the three times it was not. A live dashboard cannot answer that. A dashboard shows the present.
Timestamped records that are kept answer it, because every collection stays on file. A drift, an exception, a temporary break-glass grant: all of it is in the record with the reason attached. The record is not a snapshot. It is the history.
What you still own
Two things stay your job. First, the policy itself: NIS2 wants documented measures, and a record that a check ran does not show that you wrote the measure down. Second, the judgement call on what is in scope: you decide which sources and clauses apply to your estate.
What changes is the week before the audit. Instead of assembling screenshots, you start from records you collected on a schedule.