Beyond the Checkbox: Can Your NIS-2 Evidence Survive Reality?
Many NIS-2 readiness assessments end with a spreadsheet full of Yes/No answers. But three different organisations can all answer “Yes, we have backups” while one has only a policy, another has job logs, and only the third can demonstrate a successful restore. The checkbox is identical; the level of confidence should not be.
Drawing on exploratory research with German SMEs and practical work across NIS-2, ISO/IEC 27001 and TISAX/VDA ISA, this talk examines the gap between a claimed control and evidence that it works. Relatable examples from backup and recovery, incident handling and security governance show how assessments can confuse documentation, operation and effectiveness.
The talk introduces a simple four-part evidence lens—claim, design, operation and effectiveness—and a five-question “evidence survival test”. Neither is presented as an official framework; both are practical tools for asking better questions. Attendees will learn how to spot unsupported claims, request meaningful evidence and translate assessment gaps into prioritised security improvements.
A Yes/No self-assessment is useful for establishing initial coverage. However, it can create false confidence when it does not distinguish between a documented intention, an implemented process, recent operational evidence and demonstrated effectiveness.
The talk begins with three fictional SMEs that give the same answer to the same backup question—but possess very different evidence. This scenario establishes the central question: what should we require before accepting that a security measure actually works?
From there, the session examines recurring evidence problems through examples involving:
- backup and recovery;
- incident handling and NIS-2 reporting;
- cybersecurity governance and responsibilities.
Participants are introduced to a simple assessment lens:
- Claim: What exactly does the organisation say is implemented, and for which scope?
- Design: Are responsibilities, procedures and expected outcomes properly defined?
- Operation: Is there current evidence that the measure is performed consistently?
- Effectiveness: Has the organisation tested whether the measure achieves its intended security outcome?
The session then applies a five-question “evidence survival test”:
- What exactly are we claiming, and what is included in the scope?
- Who owns the measure, and how is it supposed to work?
- What recent evidence demonstrates consistent operation?
- How has effectiveness been tested, including failures and exceptions?
- Which concrete gap, owner and deadline follow from the assessment?
The research backdrop is an exploratory project that included outreach to 1,800 German SMEs, 17 semi-structured interviews and the development of a pragmatic NIS-2 self-assessment model. The sample is not representative and will not be presented as such; it is used to illustrate recurring practical patterns.
The talk is aimed at security practitioners, ISMS and GRC professionals, consultants and people responsible for NIS-2 implementation. No coding, penetration-testing or formal auditing background is required.
Younes Ahmadzei is an Information Security Consultant focusing on practical NIS-2 implementation, evidence-based security assessments, and translating ISO/IEC 27001 and TISAX/VDA ISA structures into actionable improvements for SMEs.
His work on NIS-2 has included outreach to 1,800 German SMEs, 17 semi-structured interviews, and the development of a pragmatic self-assessment model. He has presented his findings at BSides Munich, Elbsides, and the BSI IT Security Congress. His current work also explores how local LLMs can support the analysis of ISMS documents and security evidence while keeping final assessment decisions with human experts.