One of the most concrete requirements of NIS2 is to keep a series of registers and inventories up to date. These are not documents you create once and leave in a folder, but up-to-date records, resulting from operational and security processes, which you present at the audit. An auditor does not only look at whether the register or the evidence exists, but at whether it is up to date, consistent with reality and correlated with the rest.
The registers that matter most often
- The inventory of hardware and software assets: which equipment and applications exist in the organization, who is responsible for them, how critical they are.
- The inventory and classification of data: what data you hold, where it is stored, how sensitive it is.
- The supplier register: the critical suppliers, their services and the assessment of the associated risk.
- The risk register: the identified risks, with impact, likelihood, owner and their treatment.
- The vulnerability register: the identified vulnerabilities and the status of their remediation.
- The incident register: the security events, with traceability, decisions and notifications.
- The audit logs and the backup records, including restoration tests.
- The identity and access register and the record of approved exceptions.
Why Excel betrays you right at the audit
Each register seems manageable on its own. The problem appears with correlations: an asset must appear in the inventory, be linked to the data it processes, to the supplier that maintains it, to its risks and vulnerabilities. On random files, these correlations do not exist or are insufficient, versions contradict each other, and the auditor immediately identifies the non-conformities. The result: you waste time rebuilding the process at the very moment you need it most.
What good looks like
A healthy system keeps the registers in one place, with correlations between them, with change control, clear owners and periodic reviews. Then the registers are no longer an administrative burden, but start to make sense: they show you in advance where you are exposed and prepare your evidence for the audit. This is exactly the idea the Certudo platform is built on.