The documentation obligations under NIS2 are extensive: all measures under Art. 21, risk analyses, supplier assessments, incident reports and training evidence must be documented and producible at regulatory inspections.
What must be documented?
NIS2 requires documentation of: (1) risk analysis and security policies, (2) all implemented security measures under Art. 21, (3) supplier assessments and TPRM measures (Art. 21d), (4) incident response processes and actual incident reports, (5) business continuity plans and tests, (6) training evidence for employees and management, (7) risk treatment plans and implementation status, (8) audit results and measure tracking.
Aufsichtsbehörden setzen voraus, dass nicht dokumentierte Maßnahmen nicht existieren. Fehlende Dokumentation gilt als Compliance-Verstoß — unabhängig von tatsächlich umgesetzten Maßnahmen.
Automated documentation with 360TPRM
360TPRM automatically creates: complete TPRM reports for all suppliers, historical risk trends and analyses, compliance dashboards for NIS2/DORA/ISO 27001, audit-ready incident documentation, and exportable reports for supervisory authorities and internal audits.
Mit 360TPRM ist die TPRM-Dokumentation immer aktuell und auditfähig — ohne manuellen Aufwand.
FAQ
Automate documentation
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →