NIS2 audit in a plant: how to prepare step by step

Who is audited and when

The cybersecurity audit applies to essential entities. The Act of 23 January 2026 amending the National Cybersecurity System Act (Journal of Laws 2026, item 252) has been in force since 3 April 2026 and transposes the NIS2 Directive. The first audit of an essential entity falls within 24 months of the Act entering into force, that is by 3 April 2028, and subsequent audits at least once every 3 years.

An earlier deadline comes first: entities that meet the criteria on the day the Act enters into force have 12 months, until 3 April 2027, to fulfil the obligations of Chapter 3. These are the information security management system, documentation, incident procedures and contact persons. In 2028 the auditor will check whether these elements worked, not only whether they exist.

Financial penalties for most infringements can be imposed for the first time 2 years after the Act enters into force. The period 2026–2028 is therefore a window for building evidence, not a period without obligations. The maximum penalty for essential entities under the NIS2 Directive (Article 34) is EUR 10 million or 2% of annual turnover, whichever is higher.

What the auditor checks in an industrial plant

The audit scope follows the entity's obligations: risk assessment policy, asset analysis, ICT supply chain security, continuous monitoring, threat identification, staff training and incident response procedures. In an industrial plant each of these points has an IT part and an OT part, and the auditor usually asks for a sample from both.

For OT the questions are specific. Which controllers, HMI panels and engineering stations are in the inventory? Who had remote access to them in recent months? How does the plant prove that a service company entered the zone only for the time of the ordered work? An answer in the form of a policy is not enough: an event register is needed.

Evidence has four features

Good evidence is personal, time-stamped, states its basis (permit, order, procedure) and cannot be changed after the fact. A screenshot of a spreadsheet edited on the day of the audit meets none of these conditions.

Seven preparation steps

The order below works because each step provides material for the next one. The whole programme can be spread over several quarters, but the first three steps should be closed as soon as possible.

• Step 1. Self-identification: assess whether the entity is essential or important, and file the application for entry in the register in line with the Minister of Digital Affairs notice for your category.
• Step 2. Inventory of IT and OT assets with an owner and a network zone for each asset.
• Step 3. Risk assessment policy and a risk register with review dates.
• Step 4. Incident reporting procedure: early warning within 24 h, notification within 72 h, final report within a month, with at least two designated contact persons.
• Step 5. Register of external access and subcontractors to OT zones: who, where, when, on what basis.
• Step 6. Training: annual for management and periodic for employees, with a named list and results.
• Step 7. Internal review on a sample: draw 10 events from the last quarter and check whether each can be reconstructed from documents.

How to collect evidence from IT and OT

IT evidence usually exists: domain controller logs, tickets in the ticketing system, configurations. The problem is retention and consistency. Establish how long logs are kept, who can change them and whether time on devices is synchronised. Without a common clock you cannot build a timeline of events.

In OT the gap is of a different kind. Controllers rarely generate logs useful to an auditor, but the plant knows the physical entries: who entered the control room, who opened the control cabinet, which company worked on the line. If this data sits in a binder or an entry book, it must be moved to a form that can be searched and linked to a work permit.

Public data illustrates the risk context well. The Snitch report cited in the source card counted 8,367 unique OT hosts visible on the internet, and the CERT Polska Annual Report for 2025 points to 260,783 registered incidents. The auditor does not expect the plant to avoid every threat, only to have a process and evidence that it is applied.

Documents and standards as the backbone of evidence

Standards do not replace the Act, but they organise evidence. IEC 62443 helps describe zones, conduits and security levels in OT, ISO/IEC 27001:2022 provides a framework for an information security management system, and ISO 22301 covers business continuity. A certificate does not mean compliance with NIS2, but it is good evidence material if the certification scope covers what the auditor will examine.

A practical rule: match the standard to the scope. Describe OT under IEC 62443, the organisation under ISO 27001 and continuity under ISO 22301. A matrix that links a statutory obligation to a document and to the place where the evidence is stored is the first file the auditor will ask for.

The role of a permit and access control system

In a plant that outsources work to external companies, the trace of human presence in zones is important evidence. InnerWeb records who changed a permit or a training result and when, and when a permit is created it checks the qualifications of the assigned workers. Every QR badge scan at the gate goes to the entry and exit register. This supports meeting the external access register requirement and provides evidence for the audit, but it does not replace a security policy or risk assessments.

InnerWeb is an independent system that complements and tightens the client's existing permit and training systems. It does not have to replace them for the audit trail to become consistent.