evidence kit
NIS2 access evidence map
22 access control requirements from NIS2, the implementing regulation and the Polish act, each matched to something you can export, an owner and a date.
what this is
This kit is for whoever runs IT at a company of 50 to 1000 people, in scope or probably in scope of national NIS2 law. An auditor, a customer questionnaire or your board will ask what you do about access and how you can prove it. This map links each requirement to a file you can produce.
It does not tell you whether you are in scope. Use the finder and a lawyer for that. It covers logical access only, because that is where the same proof gets asked for most often.
It names no products. "Identity provider" means whatever holds your user accounts. Find the matching report in your own product's documentation, and record its log retention period while you are there, because defaults can be short.
basis NIS2 Art. 21(2)(i), 21(2)(j)
from a control to an answer
- 1the control runsan access review, a restore test, a board decision
- 2it leaves a recorda dated export, a signed sheet, a minute
- 3an owner checks ita named person, on a set rhythm
- 4it gets filedone place, named by date and control
the same file answers
- your boardwhat did we decide, and is it running?
- an auditorshow me the last one
- a regulatorwere your measures appropriate?
- a customerthe security questionnaire
basis GDPR Art. 5(2), 24(1); NIS2 Art. 21(2)(f)
who the texts bind
The implementing regulation binds only listed digital types: DNS, top-level domain registries, cloud, data centres, content delivery, managed and managed security services, online marketplaces, search engines, social networks and trust services. For anyone else its rows are marked Reference. They remain the most detailed EU wording on access control, and you should say in your documents that you use them that way. Poland applies it to the same types through its national act, and rules elsewhere may differ.
Neither NIS2 nor the implementing regulation sets a review frequency, a log retention period or a password length. So every interval in this map is a suggestion marked as a choice. Change them and write down why, because an auditor will look for the reason.
basis IR 2024/2690 Art. 1, Annex 11.2.3; KSC Art. 8b(1)
how to use it
- Download the CSV and open it in any spreadsheet. Delete the rows that do not apply, such as the Polish ones outside Poland.
- Rewrite the control column so it describes what you do. Keep the reference column as it is.
- Pull each export and save it with a date and row id in the name, for example
2026-11-02_CM-06_admins.csv. - Mark anything you cannot evidence as a gap, with an owner and a date. A gap with a plan is better audit material than a blank cell.
basis working practice. No legal text sets this.
the map
| row | reference | binding | what the text asks | your control (edit this) | evidence | how often | owner |
|---|---|---|---|---|---|---|---|
| CM-01 | NIS2 Art. 21(2)(i) | Binding | access control policies | We keep an approved access control policy, reviewed yearly | signed policy with approval date | yearly | head of IT |
| CM-02 | NIS2 Art. 20(1) | Binding | management approves and oversees the measures | The board approves the policy and receives a yearly report | board minute extract with date | yearly | company secretary |
| CM-03 | IR 2024/2690 Annex 11.1.1 | Reference | establish, document and implement access control policies | The same policy covers staff, suppliers and systems | policy section list mapped to points (a) to (c) of Annex 11.1.2 | yearly | head of IT |
| CM-04 | IR 2024/2690 Annex 11.2.2(e) | Reference | a register of access rights granted | We keep an access register for our ten most important systems | index of systems plus one export for each | quarterly | system owners |
| CM-05 | IR 2024/2690 Annex 11.2.2(b) | Reference | change rights on termination or change of employment | Accounts are disabled on the last working day; HR list reconciled monthly | HR leaver list compared with enabled accounts | monthly | HR and head of IT |
| CM-06 | IR 2024/2690 Annex 11.3.2(a) | Reference | strong authentication such as MFA for privileged accounts | All admin role holders must pass MFA | admin list, MFA registration report, enforcement policy | quarterly | head of IT |
| CM-07 | IR 2024/2690 Annex 11.3.2(b) | Reference | accounts used for system administration only | Admin roles are held only by separate admin accounts | admin list compared with everyday accounts | quarterly | head of IT |
| CM-08 | IR 2024/2690 Annex 11.3.3 | Reference | review privileged rights at planned intervals, document the result | Admin roles are reviewed every quarter (our choice) with sign-off | review record: date, reviewer, removals | quarterly | head of IT |
| CM-09 | IR 2024/2690 Annex 11.2.3 | Reference | review access rights at planned intervals, document the result | Business systems every 6 months, critical ones every quarter (our choice) | completed reviews with removal counts | every 6 months | system owners |
| CM-10 | IR 2024/2690 Annex 11.2.2(f) | Reference | log the management of access rights | Admin logs are archived for 12 months (our choice) | archive setting screenshot and a sample export | yearly | head of IT |
| CM-11 | IR 2024/2690 Annex 11.5.3 | Reference | shared identities only where necessary, approved and documented | Shared accounts are registered and approved | shared account register with approver | quarterly | head of IT |
| CM-12 | IR 2024/2690 Annex 11.5.4 | Reference | review identities, deactivate those no longer needed without delay | Enabled accounts with no sign-in for 90 days are reviewed monthly (our threshold) | user export filtered on last sign-in | monthly | head of IT |
| CM-13 | IR 2024/2690 Annex 11.2.2(d) | Reference | limit third-party access in scope and duration | Guest and supplier accounts have a sponsor and an end date | guest export with created date and last sign-in | quarterly | head of IT |
| CM-14 | IR 2024/2690 Annex 11.7.1 | Reference | MFA where appropriate, by asset classification | All users use MFA for all resources; exceptions listed and approved | enforcement policy and exception list | quarterly | head of IT |
| CM-15 | NIS2 Art. 21(2)(j) | Binding | MFA or continuous authentication where appropriate | Same control as CM-14 | same as CM-14 plus registration report | quarterly | head of IT |
| CM-16 | KSC Art. 8(1)(2)(l) | Binding in Poland | multi-factor authentication where appropriate | Same control as CM-14; exception list approved by management | exception list with approval date | every 6 months | management |
| CM-17 | IR 2024/2690 Annex 11.6.2(c) | Reference | change credentials initially, at set intervals, on suspected compromise | Write down your intervals and your reasons | password policy text and a settings screenshot | yearly | head of IT |
| CM-18 | IR 2024/2690 Annex 11.6.2(f) | Reference | separate credentials for privileged access | Admin accounts do not share credentials with everyday accounts | sample comparison of admin and everyday accounts | yearly | head of IT |
| CM-19 | NIS2 Art. 21(2)(i) | Binding | asset management | We keep a list of systems with their owners | system list with owner and classification | twice a year | head of IT |
| CM-20 | IR 2024/2690 Annex 11.5.2(b) | Reference | link the identity of users to a single person | Every user identity maps to one named person | user export matched to HR list | quarterly | head of IT |
| CM-21 | KSC Art. 7c(1) | Binding in Poland | apply for entry in the register within 6 months of meeting the criteria | Our entry is filed; the signing person and login are recorded | copy of the application and the confirmation | on change | management |
| CM-22 | KSC Art. 8e(3) | Binding in Poland | documented yearly training for the head of the entity | Management training is booked and recorded every calendar year | attendance record | yearly | company secretary |
basis reference column, row by row
one review, signed once
- 1exportwho has access today
- 2confirmthe system owner marks each name
- 3removewhat nobody could explain
- 4sign and dateand file the result
that file helps answer
- NIS2access control
- DORAaccess rights
- GDPRconfidentiality
- ISO 27001access rights
- SOC 2logical access
basis NIS2 Art. 21(2)(i); DORA Art. 9(4)(c); GDPR Art. 32(1)(b). ISO 27001 and SOC 2 not re-read at source.
questions an auditor is likely to ask
These are illustrations of the kind of question that follows from the texts. They are not from any published audit standard.
- Show me your access control policy and who approved it.
- Who holds the highest admin role today, and how do they sign in?
- Which accounts are excluded from MFA, and who approved each one?
- Show me the last review of your most critical system and what it removed.
- Pick a leaver from last quarter. When was the account disabled, and where is the log?
- Which suppliers have accounts with you, and when do they end?
- How long do you keep sign-in and admin logs, and why that long?
basis working practice. No legal text sets this.
what this leaves out
- Whether you are an essential or important entity.
- The rest of the NIS2 list: incidents, continuity, supply chain, vulnerabilities, cryptography and training each have their own page.
- Physical access, sector rules and national implementing acts.
basis NIS2 Art. 21(2); IR 2024/2690 Annex 11.1.1; KSC Art. 8a
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
- Ministry of Digital Affairs (Poland): the amended act comes into force
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Download the map, delete the rows that do not fit, and pull your admin list today.