Internal Safety Audit Questionnaire

1. Organisational controls - management and risks

Security policy approved, dated, notifiedThe date of approval and proof of notification shall be presented.Risk: Policies without management approval are not binding and are not respected.Verification: Compare the date of approval with the last major changes to the organisation.Proof: Signed policy with date and notification record.NIS2: 21(2)(a).
Has designated person managing cybersecurityIts responsibilities and responsibilities are laid down in writing and there is a certain substitute.Risk: Without the responsibility for security, the tasks remain between the departments.Verification: Ask who decides on an incident outside working hours.Proof: Order or description of post with a substitute.NIS2: article 20.
Management has approved and is responsible for risk management measuresApproval dated. The leadership can explain what was confirmed.Risk: Measures without a management decision are not resourced.Verification: The management member shall explain at least two approved measures.Proof: Minutes of the management sitting with a date.NIS2: article 20.
Management trained to recognise and evaluate cyber risksSeparate from staff training - the responsibility is different.Risk: Management is unable to assess the risks for which it is responsible.Verification: The training shall cover the last 12 months and shall cover all management members.Proof: List and content of training.NIS2: article 20.
Risk register renewed over the last 12 monthsWith owner, level of risk and action for each record.Risk: An outdated register does not see new systems and threats.Verification: Check that the two events of the last year are in the register.Proof: Register with dates of change and owners.NIS2: 21(2)(a).

2. Organisational controls - assets and data

Assets inventory current and with ownersRisk: No one updates or monitors an unaccounted installation.Verification: Compare inventory to network scan result.Proof: Annex V. Part 2.NIS2: 21 (2) (i).
List of authorised software, unauthorized removedNot only is what is installed, but what you must be.Risk: Unauthorised software bypass updates and monitoring.Verification: Compare the installed on the sample equipment with the permitted.Proof: List of authorised software and deviation report.NIS2: 21(2)(a).
Classification of data and retention periodsWhat is sensitive, how long is stored when deleted.Risk: The data is stored longer than necessary and the volume of leakage is growing.Verification: Check that older entries in one system correspond to the deadline.Proof: Classification procedure and deletion records.NIS2: 21 (2) (i).
Register of processing operations maintainedWhat personal data, for what purpose, been transferred.Risk: Without knowing where personal data are, leakage cannot be assessed in a timely manner.Verification: Compare the register with the system list.Proof: Register with date of last renewal.NIS2: 21 (2) (i).
Data protection impact assessment performed for high risk processingNot after the start of treatment. The last valuation shall be reported.Risk: High risk treatment starts without protective measures.Verification: Check the last new system with personal data.Proof: Impact assessment with date before implementation.NIS2: 21(2)(a).

3. Organisational controls - supply chain

List of critical suppliers with a risk classificationWho has access to data or the production environment.Risk: Critical supplier failure or compromise surprises.Verification: Check that each has a risk assessment.Proof: List of suppliers with classification.NIS2: 21(2)(d).
Safeguard and notification clauses in supplier contractsTime limit for incident notification, audit rights, data processing.Risk: Find out too late about the supplier's incident.Verification: Check contracts between two critical suppliers.Proof: Contract clauses.NIS2: 21(2)(d).
An exit plan for each critical supplierRecovery and withdrawal of access.Risk: Leaving the supplier means loss of data or idleness.Verification: Check that data are recoverable in a usable format.Proof: Cessation plan.NIS2: 21(2)(d).

4. Organisational controls - incidents, continuity and reporting

Record of incidents maintained, response plan currentRisk: Repeated incidents shall not be detected.Verification: Check the last incident record.Proof: Register and plan with date.NIS2: 21 (2) (b).
Reporting deadlines known and verifiedEarly warning 24 h, notice 72 h, final report within one month of notification.Risk: Delayed report means sanctions.Verification: Ask the deadline and addressee responsible.Proof: Reporting arrangements and forms.NIS2: article 23.
Responding to proven exercises, not only describedTable training or simulation with recorded conclusions.Risk: The plan doesn't survive the first real incident.Verification: Test the conclusions of the last exercise.Proof: Training protocol.NIS2: 21 (2) (b).
Secure means of communication, including emergency communication, identified and testedAs a team communicates if the email or internal chat is compromised.Risk: The command cannot communicate when basic systems fall.Verification: Check that the backup channel is running.Proof: A list of channels and an inspection record.NIS2: 21 (2) (j).
Business continuity and crisis management plan approved and testedWho decides how to communicate and which services are renewable first.Risk: In the crisis decisions are taken by improvising.Verification: Test the conclusions of the last trial.Proof: Plan and pilot protocol.NIS2: 21(2)(c).
Objectives of renewal time and data loss defined and verified during trainingRisk: Restoration lasts longer than the organisation can withstand.Verification: Compare goals with learning outcomes.Proof: Objectives and learning protocol.NIS2: 21(2)(c).
Affected service recipients informed when an incident affects themEven when a technical service works.Risk: Customers cannot protect themselves on time.Verification: Check the order and last case.Proof: Notification template and transmission record.NIS2: article 23.

5. Organisational controls - Supervisory Authority and Effectiveness

Organisation registered with the supervisory authority and contact person notifiedContact details are also up to date outside working hours.Risk: The supervisory authority may not communicate during an incident.Verification: Compare registered contacts with current ones.Proof: Registration approval.NIS2: article 27.
Notification of significant changes to the supervisory authorityName, contact person, services provided.Risk: The Authority has outdated information at its disposal.Verification: Check the latest changes and the notification.Proof: Copy of the notification.NIS2: article 27.
Self-assessment submitted within the deadlineRisk: Delayed self-assessment is a violation.Verification: Check the date of submission.Proof: Submission confirmation.NIS2: 21 (2) (f).
Disclosure policy publishedContact and expiration date in machine readable format.Risk: The finder doesn't know where to report.Verification: The deadline for the published contacts and checks shall be opened.Proof: Published policy.NIS2: 21 (2) (e).
Intrusion test carried out within the last 12 monthsWith confirmation of finding prevention, not just a message.Risk: Unknown holes remain open.Verification: Check that the findings have been eliminated.Proof: Test report and approval of modifications.NIS2: 21 (2) (f).
Control efficiency measured with predefined valuesControls, the effectiveness of which is not measured by anyone, are not controls.Risk: Controls exist only on paper.Verification: Check the values of the indicators in the last period.Proof: Indicator report.NIS2: 21 (2) (f).
Previous audit findings eliminated and verifiedRisk: The same shortcomings are repeated.Verification: Find proof of correction for each finding.Proof: List of findings with status.NIS2: 21 (2) (f).

6. Personnel controls

Prior to recruitment due diligenceThe amount shall correspond to the level of access to the post.Risk: Access to critical systems is received by an unverified person.Verification: Sample the last two employees recruited.Proof: Check record on the staff file.NIS2: 21 (2) (i).
Confidentiality and security obligations in contractsIn force after termination of employment.Risk: The information obtained in the job may be used by the mover.Verification: Check the model contract and two signed contracts.Proof: Signed commitments.NIS2: 21 (2) (i).
Security duties described in the job descriptionsRisk: Nobody knows who is responsible for a particular security action.Verification: Compare the job description with the actual rights.Proof: Description of posts with security responsibilities.NIS2: 21 (2) (i).
Security training for all staffOver the past 12 months. The list of members shall be reported.Risk: Phishing and errors is the most frequent start of an incident.Verification: Compare the list of participants with the list of employees.Proof: Training list and results.NIS2: 21 (2) (g).
Departure process: access withdrawn, actively returnedThe same day. Shows the last deceased as an example.Risk: The former staff account shall remain active.Verification: Check the last deceased accounts in all systems.Proof: Departure check list with dates.NIS2: 21 (2) (i).
Disciplinary proceedings in the event of infringements knownRisk: Irregularities have no consequences, and the rules become meaningless.Verification: Ask the manager what he would do if he were wrong.Proof: Approved procedure.NIS2: 21 (2) (i).

7. Technological controls - identity and access

Review of user rights≥ every 6 months. This column shall not be reported in case of securitisation of liabilities.Risk: Rights accumulate as positions change.Verification: Check whether any rights were withdrawn in the last report.Proof: Result of the review with changes.NIS2: 21 (2) (i).
Password policy followedAt least 15 symbols if the password is the only factor. Passwords tested against leaked and stored with slow mixing function (Argon2id, scratcht, bcrypt).Risk: Poor or leaked passwords give direct access.Verification: Check system settings, not just the document.Proof: Configuration printout.NIS2: 21 (2) (i).
Reserved accounts separate from daily accountsThe activities of the administrator shall be traceable to the person.Risk: A compromised daily account gives administrator rights.Verification: Compare the accounts to sample administrators.Proof: List of privileged accounts.NIS2: 21 (2) (i).
Remote access protected by multifactor authenticationRisk: Remote access only with a password is the most common entry.Verification: Try to connect without the other factor.Proof: Configuration and login log.NIS2: 21 (2) (j).
Shared and service accounts inventory and reasonableRisk: The operations of a shared account cannot be linked to a person.Verification: Check who knows the password of each service account.Proof: List of service accounts with owners.NIS2: 21 (2) (i).

8. Technological controls - development, changes and software delivery

Changes to approved, traceable and return routesRisk: An uncontrolled change causes a downtime or hole.Verification: Find confirmation for the last change.Proof: Requests for changes.NIS2: 21 (2) (e).
Design, test and production environments separatedThe production data in the test medium are not used unprocessed.Risk: Test error or data goes to production.Verification: Test access and data in the test environment.Proof: Environmental description.NIS2: 21 (2) (e).
Code changes reviewed before entry into productionRisk: Mistakes and deliberate holes end up in production.Verification: Find the reviewer for the selection changes.Proof: Review records.NIS2: 21 (2) (e).
Security requirements included in the procurement of new solutionsRisk: The purchased solution does not meet the safety requirements.Verification: Check the last procurement.Proof: List of requirements in procurement.NIS2: 21 (2) (e).
Software Component List (SBOM) generated and currentMachine-readable format. Updated at every release, not once a year.Risk: In the case of new vulnerabilities, it is not known where it is.Verification: Check that the list corresponds to the last tranche.Proof: List of components with release date.NIS2: 21 (2) (e).
Dependence required by version and check-sumWithout it, the construction cannot be repeated.Risk: The construction has a different code than was verified.Verification: Check addictive file.Proof: Fixed addictive file with checksums.NIS2: 21 (2) (e).
Dependence vulnerability scans automaticallyScanning by construction. Shows the treatment of the last finds.Risk: Known vulnerability goes into production.Verification: Check the handling of the last finds.Proof: Scan report and corrections.NIS2: 21 (2) (e).
Pictures of containers scanned and from a known sourceThe base image is pinned and restored to each construction.Risk: The base image brings old vulnerabilities.Verification: Check the date on which the last image was built.Proof: Scan report.NIS2: 21 (2) (e).

9. Technological controls - operation, copies and monitoring

Security updates applied within the policy deadlinesFor actively used injuries - days, not month. The reporting of updates of the last month shall be performed.Risk: Some vulnerability remains open.Verification: Compare installation dates with publication dates.Proof: Update report.NIS2: 21 (2) (e).
Backup performed and restoration tested in the last 3 monthsAn untested copy is not a copy - a renewal report is presented.Risk: A copy shall not be used when it is needed.Verification: Check the last renewal test and its duration.Proof: The renewal protocol.NIS2: 21(2)(c).
Spare copies stored separately and protected against erasureRisk: The spy virus also destroys copies.Verification: Check that copies can be deleted by the administrator.Proof: Storage configuration.NIS2: 21(2)(c).
Collection and preservation of audit windows ≥ 12 monthsRisk: Incidents cannot be investigated because there are no feet.Verification: Check the date of the oldest available record.Proof: Storage settings.NIS2: 21 (2) (b).
Anxiety Really Reachs ResponsibleWindow collection is not detection - a verified alarm is displayed.Risk: Nobody reads the warning.Verification: Make sure the test alarm and the reaction time.Proof: Test alert record.NIS2: 21 (2) (b).
Outgoing traffic monitored and abnormal visibleIncoming filtering does not reveal a compromise that has already taken place.Risk: The leak and the control channel go unnoticed.Verification: Check that an unusual outgoing connection creates a warning.Proof: Surveillance rules and warnings.NIS2: 21 (2) (b).
The infrastructure has also been scanned for injuryNot only for addiction - also for servers and network.Risk: Infrastructure holes remain unknown.Verification: Check the date of the last scan and the processing of finds.Proof: Scan report.NIS2: 21 (2) (e).

10. Technological controls - configuration, network and encryption

11. Physical controls

Facilities physically separate from common areasServer room is not a hallway, kitchen or open office.Risk: Appliances can be accessed by anyone who passes.Verification: Look at the server room and its doors.Proof: Space plan and access list.NIS2: 21(1).
Access to premises controlled and registeredVisitors spent and registered, list transparent.Risk: The inappropriate person comes to the equipment unnoticed.Verification: Compare the visitor magazine with one day's fact.Proof: Visitor and Access Log.NIS2: 21(1).
Right of access to premises reviewed and withdrawn in due timeRisk: Keys and cards remain for the dead.Verification: Compare map list with employee list.Proof: Report entry with revoked cards.NIS2: 21(1).
Power, cooling and fire protection provided in equipment roomSpare power tested, not only installed.Risk: The failure of current or cooling shall stop the service.Verification: Check the last backup power test.Proof: Test report and maintenance records.NIS2: 21(1).
Space monitored and intrusion visibleAlarm or video surveillance with stored records.Risk: It's only after the loss that reveals the matter.Verification: Check that records are available for the last 30 days.Proof: Alarm and video surveillance log.NIS2: 21(1).
Data centre or hosting service security assessedIn the case of equipment with a service provider, proof thereof shall be presented.Risk: The weakness of the provider becomes your risk.Verification: Check that the attestation is valid for that year.Proof: Statement by the provider or audit report.NIS2: 21(1).
Reliable and certified mediaDiscs, backup carriers, paper.Risk: Detached discs and papers reveal data.Verification: Check for the last destruction.Proof: Act of destruction.NIS2: 21(1).
Clean table and clean screen practice followedRisk: Replaced documents and unlocked screens are easily accessible.Verification: Walk around the office after working hours.Proof: Walking tape.NIS2: 21(1).