Passing NIS-2 Audits – Why Historical Asset Data is Now Crucial for Survival

The EU directive NIS-2 has been dominating the agendas of CIOs, CISOs, and IT managers for some time now. While the initial phase focused primarily on theoretical concepts, affected sectors, and looming fines, a very different reality has now set in: the phase of implementation – and, above all, the phase of proof.

Audits are coming up, and auditors are no longer satisfied with well-written Security concepts. They demand evidence. They want to see that the defined Security measures do not just exist on paper but are applied seamlessly and continuously across the entire IT Infrastructure.

In this critical phase, many organizations are encountering a massive problem they often overlooked during NIS-2 preparation: the lack of historical Asset data.

The Snapshot Dilemma

To understand the problem, we need to look at how most companies document their IT Assets (Servers, software, Cloud services, network elements) today. This is usually done via a classic Configuration Management Database (CMDB) or, in less mature environments, via spreadsheets.

• When an IT administrator looks into these systems today, they see, at best, the current state of the IT landscape. They see which Servers are currently running, which software version is installed, and who owns a system. This is undoubtedly important for daily IT Operations (ITOM) and basic Asset Management (ITAM).

However, for a Compliance Audit, this "snapshot" is not enough. An Auditor reviewing a company under NIS-2 in October will ask questions like:

“What did your network segmentation look like on March 14th of this year?” “Which unpatched Assets were in your network six months ago, and how quickly were they updated after the vulnerability became known?” “Can you prove that the security policy introduced in January has been continuously applied to all newly added Cloud instances since then?”

Anyone who can only present the current status of their IT will find themselves in need of explanation. Without a complete history of IT Assets, changes, trends, and continuous adherence to Security requirements simply cannot be proven.

Compliance requires a "time machine" for IT

• In practice, the requirement of NIS-2 (and comparable frameworks like ISO 27001 or BSI IT-Grundschutz) is Continuous Compliance. The Security of information systems must be permanently guaranteed and verifiable.
• This means that modern IT documentation must be able to travel back in time. IT managers need the ability to retrieve the IT architecture of any date in the past and compare it with other points in time.

Only historical data allows for the generation of decisive evidence

Change Tracking: When exactly was a critical Server moved to an unprotected zone? Was this change documented and authorized? Vulnerability Remediation: How long was software version X in the network before the update was rolled out across the board? Lifecycle Documentation: When was an Asset added to the network, and was it configured correctly from day 1?

Why Classic Tools Fail

Attempting to map this historization manually is doomed to fail. Today's IT landscapes are far too dynamic. Virtual machines in the Cloud are often spun up for only hours or days (Ephemeral Assets). If these are not automatically recorded and stored in a history, they simply do not exist for auditors in hindsight – a clear violation of the required transparency.

Many traditional CMDBs do keep change logs for individual Configuration Items, but they are not designed to reconstruct the full structure and all dependencies of an IT landscape at any given point in the past as a coherent overall picture.

The Path to Automated Evidence Generation

• The solution to this problem lies in an automated, data-driven approach to IT Asset management. Instead of relying on manual entries, data from existing systems (Cloud providers, virtualization environments, network scanners) must be consolidated continuously and fully automatically.

The decisive factor is that this central platform must timestamp every change to the state of IT – every added Asset, every changed configuration, every update – and store it in a tamper-proof manner.

Qbilon specializes exactly in this requirement. With our automated platform, we create a Single Source of Truth that not only maps the current state but functions as an "IT memory." By storing historical Asset data, Qbilon enables IT teams to generate precise reports and evidence for any point in the past at the touch of a button.

Conclusion: Throw Away the Excel Sheets

NIS-2 is forcing companies to radically professionalize their IT documentation. The days when an approximate snapshot of IT Assets was sufficient for an Audit are finally over. Those who cannot provide historical data about their IT Infrastructure today are walking blindly into the next Compliance Audit.

Use the pressure from NIS-2 as an opportunity: Say goodbye to static lists and invest in automated, historized IT landscape documentation. This not only saves valuable resources and nerves before the next Audit but also forms the necessary foundation for true cybersecurity.