From Checkbox to Evidence: A Hands-On NIS-2 Assessment for a Fictional SME
Many security assessments end with a simple “yes” or “no”. Yet “yes” may mean that a policy exists, that someone believes a process is followed, or that operational evidence demonstrates the measure actually works.
In this four-hour workshop, participants become the assessment team for “Musterwerk 180”, a fictional German SME. Working in small groups, they will review synthetic policies, responsibilities, incident records, backup logs, test results, risk information, and management records. Using a simple assessment lens - claim, design, operation, and effectiveness - they will evaluate selected NIS-2 security measures, identify missing or contradictory evidence, formulate targeted follow-up requests, and prioritise practical improvements.
The workshop covers three cases: backup and recovery, incident handling and reporting, and cybersecurity governance. It requires no coding and no detailed knowledge of individual standards.
Participants will leave with a reusable evidence-assessment worksheet, a structured method for requesting better evidence, and an approach for turning assessment findings into a prioritised improvement plan.
A checked box does not necessarily demonstrate that a security measure has been implemented or that it works as intended. A policy may describe a good process while operational records reveal exceptions, inconsistent execution, missing responsibilities, or a lack of effectiveness testing.
This workshop gives participants the opportunity to perform an evidence-based assessment rather than only discuss one.
Scenario
Participants act as the assessment team for “Musterwerk 180”, a fictional German SME preparing for NIS-2. The company claims to have already implemented several relevant security measures. Each team receives a synthetic evidence pack containing selected documents such as:
- company and scope information,
- policies and process descriptions,
- roles and responsibilities,
- backup logs and a restore-test record,
- incident tickets and escalation information,
- risk and management records.
All materials are fictional and have been created specifically for the workshop.
Assessment lens
For the exercises, participants distinguish between four perspectives:
- Claim: What does the organisation say it does?
- Design: What do policies, responsibilities, and procedures require?
- Operation: What evidence shows that the process is actually performed?
- Effectiveness: What demonstrates that the measure works and that identified problems are addressed?
This is used as a practical assessment lens for the exercises, not as an official NIS-2 maturity model.
Workshop structure
Introduction and guided warm-up - 45 minutes
Participants are introduced to Musterwerk 180 and the assessment approach. In a guided backup example, additional evidence is released in stages to demonstrate how an assessment changes when a policy, operational logs, and effectiveness-test results become available.
Case 1: Backup and recovery - 45 minutes
Teams assess whether the available documents demonstrate only a documented backup process or also operational recoverability. They identify missing evidence and formulate targeted follow-up requests.
Calibration and break - 30 minutes
The teams compare their decisions and discuss why different assessors may rate the same evidence differently. This is followed by a short break.
Case 2: Incident handling and NIS-2 reporting - 45 minutes
Participants review an existing incident-response process and operational records. They assess which elements are reusable and whether responsibilities, incident classification, regulatory reporting, timelines, and supporting evidence are sufficiently addressed.
Case 3: Cybersecurity governance - 35 minutes
The company claims that management is actively involved in cybersecurity. Teams examine assigned responsibilities, meeting records, decisions, risk information, and the follow-up of security measures to determine what this claim is actually supported by.
Assessment calibration - 25 minutes
Each group presents and defends one assessment decision. Together, the participants develop more consistent criteria for distinguishing between insufficient, partial, and convincing evidence.
Prioritised improvement plan and wrap-up - 15 minutes
Teams convert their most important gaps into a short improvement plan containing an action, responsible role, expected evidence, and priority.
Learning outcomes
After the workshop, participants will be able to:
- distinguish documentation from operational and effectiveness evidence,
- recognise incomplete or contradictory evidence,
- formulate precise and useful evidence requests,
- explain and calibrate assessment decisions,
- translate assessment gaps into prioritised actions.
No coding, special software, or detailed prior knowledge of ISO 27001 or TISAX is required. Basic familiarity with information security, risk, compliance, or audit activities is helpful.
Younes Ahmadzei is an Information Security Consultant focusing on practical NIS-2 implementation, evidence-based security assessments, and translating ISO/IEC 27001 and TISAX/VDA ISA structures into actionable improvements for SMEs.
His work on NIS-2 has included outreach to 1,800 German SMEs, 17 semi-structured interviews, and the development of a pragmatic self-assessment model. He has presented his findings at BSides Munich, Elbsides, and the BSI IT Security Congress. His current work also explores how local LLMs can support the analysis of ISMS documents and security evidence while keeping final assessment decisions with human experts.