NIS-2 in Practice: How to Automate Your Compliance Evidence

The NIS-2 directive has the European IT landscape firmly in its grip. Now that the initial dust has settled regarding which companies fall into the "essential" and "important" categories, IT managers, Compliance officers, and CISOs are facing the harsh reality of implementation. Budgets have been allocated, Security policies have been rewritten, and technological protective measures have been implemented. However, all these efforts are worthless in the event of an Audit if one crucial piece of the puzzle is missing: evidence. Under NIS-2, a brutal principle applies: what cannot be documented and proven does not exist for the Auditor. In practice, this means that companies must not only claim that they take cybersecurity seriously but must also prove this seamlessly using hard, historical data. In this post, we show why manual evidence generation is a dead end and how you can master this process through targeted automation.

The Burden of Proof: Why Evidence is So Painful

In an Audit context, evidence is the irrefutable proof that a defined control or Security measure has been effectively and permanently implemented. Let’s take a classic example from risk management under NIS-2: The company has a policy that all Servers processing customer data must have up-to-date Endpoint Detection and Response (EDR) software. For the Auditor, it is not enough to read this policy in the manual. They will ask:

• Show me a complete list of all Servers that process customer data.
• Prove to me that the EDR software is installed and actively running on every single one of these Servers.
• Prove to me that this is not just the case today, but has been consistently the case for the last six months. When a company has to compile this data manually, chaos ensues. Administrators must export data sheets from the Cloud console, compare them with the outdated CMDB, and sift through EDR solution log files. The data is often contradictory (Server X has a different name in Azure than in the EDR tool), incomplete, or has chronological gaps. The result: weeks of preparation, stressed teams, and, in the worst case, a failed Audit.

The Way Out of the Dead End: Continuous Compliance

To solve this problem, organizations must internalize the concept of "Continuous Compliance." Compliance is not a project that you start once a year, four weeks before the Audit. It is a permanent state that is monitored automatically in the background. The key to this lies in Asset management. If you know what your Infrastructure looks like in real-time and with historical evidence, you have already completed 80% of the Compliance work. The following steps are essential for automating evidence generation: Step 1: Automated Data Collection (Discovery)Say goodbye to manually maintained lists. Use tools that connect directly to your data sources via APIs – Cloud platforms, virtualization servers, network scanners, Active Directory, and security tools. The system must independently recognize new Assets (such as booted virtual machines) and transfer them into a central data model. Step 2: Creation of a Single Source of TruthThe collected data must be normalized and linked together. The central platform must recognize that the IP address from the network scanner, the instance ID from the Cloud, and the hostname from the EDR tool all belong to the same physical or virtual Asset. Only this consolidation creates a reliable data basis. Step 3: History Tracking of Asset DataAs discussed in our last post, all changes must be timestamped and archived. If the Auditor asks about the status in March, the system must not break a sweat but must be able to reconstruct the Infrastructure of that time at the push of a button. Step 4: Automated Policy ChecksThis is where automation unfolds its full power. Instead of comparing data manually, you define rules (policies) in your central Asset platform. For example: "Every Asset with the 'Production' tag MUST have a running backup solution." The system continuously checks this rule against the actual, historical state of the IT.

Compliance at the Push of a Button

When these four steps are implemented, a NIS-2 Audit loses its terror. If the auditor requires evidence, no one has to compare Excel lists anymore. You open your central management platform, select the required period, and export the report that proves beyond doubt that the defined rules were applied to the entire, correctly inventoried Asset portfolio. Solutions like the Qbilon platform are designed exactly for this challenge. They take the tedious, error-prone collection work off the hands of IT teams and translate raw data into Audit-proof evidence. This not only reduces personnel effort enormously but also gives management the Security that the strict requirements of NIS-2 are met without gaps. Don't let Compliance become a stress test for your best IT talent. Automate the foundation – your Asset inventory – and let the data speak for itself.