NIS2 audit in three mandates

NIS2 has been German national law since 6 December 2025: the implementation act was promulgated on 5 December 2025 (BGBl. 2025 I Nr. 301) and entered into force the day after. 17 October 2024 was the directive's transposition deadline, not the date it began to apply.

In the fourth quarter of 2025 we brought three mid-market mandates to audit-ready state: a machine builder, a municipal energy utility and a consulting firm. This note summarizes what worked and where money was burnt.

What actually works

Documentation before tooling. All three mandates already had reasonable security building blocks: patching, endpoint detection, MFA. What was missing was credible documentation: who is responsible, who decides in an incident, how long does escalation take? NIS2 auditors examine processes, not logos.

Simulate incidents. Three tabletop exercises in three months brought more clarity than new tools. A tabletop reveals that the escalation path "call the CISO" doesn't work if the CISO role isn't filled. That was quickly fixed: we take the role on inside our Virtual CISO model.

Document the supply chain. The NIS2 requirement for supplier security is underestimated. We set up a simple supplier register for each mandate (critical providers, contractual clauses, contact paths) and covered the top-10 suppliers with security questionnaires. Auditors were satisfied afterward.

Where money was burnt

A compliance tool bought that nobody maintains. One mandate had subscribed to a GRC platform nobody uses. Such tools without an owner are worthless. We switched it off and used a Confluence space plus the audit log of our Nova9 platform instead. It is cheaper and actually maintained.

Penetration tests before hygiene. One mandate wanted a pentest before basic hygiene was in place. Result: a hundred findings, eighty of them fixable in the first two weeks with hardening. Our recommendation today: hardening first, then pentest. Otherwise you pay for a defect list you could have produced without the pentest.

What Nova9 contributed

Our platform's audit trails provide the evidence for the reporting duties under § 32 BSIG with no extra work. Every agent action is signed, time-stamped and searchable. In one of the audits this is what convinced the auditor that the 24-hour deadline for the initial report is demonstrably met.

Concrete recommendation

If you haven't started yet:

1. Clarify responsibilities. Who carries incident responsibility? Who informs the supervisory authority? Write it down.
2. Simulate your top five incidents. Tabletop, one hour per scenario.
3. Set up a supplier register. No Excel graveyard. Plain Markdown is enough.
4. Turn on audit trails. On every system that runs in production.