Skip to content

Evidence and suppliers

Audit, supplier and oversight evidence checklist

Pick a scenario, mark the documents already in hand and copy what is still missing. It is the list that usually lives in a shared sheet the day before the audit.

Items marked in this scenario 0%

Critical NIS2/DORA supplier qualification

Still to request

    An indicative aid for compliance work. It is not legal advice, a filing with an authority, or a certification.

    Four scenarios, the same basic proof

    An ISO/IEC 27001 auditor, a NIS2 customer, the DPO and the oversight body do not share an index, but they all want dated proof and an owner. The checklist splits four typical requests without duplicating a file that is already good enough for more than one front.

    The percentage is not a compliance score. It only says how many items on that list are marked present in this browser session. Nothing is stored on the server.

    What to ask a supplier without an endless questionnaire

    For a critical ICT supplier, the short list is often enough: service scope, incident contacts, the latest restore test, privileged access, where the data sits and how subcontractors are used. Ask for the rest when the service risk requires it.

    For the GDPR, an article 28 appointment belongs with documented instructions and proof the supplier follows them, not only with a signed DPA.

    From a tick to a request

    Copy the open items and send them to the owner or the supplier with a date. If the same request returns every quarter, a secure expiring link should replace the email.

    Connects with

    FAQ

    Does the checklist replace an ISO 27001 audit?

    No. It lists proof a pre-audit often looks at. It does not cover all of Annex A and it does not raise a nonconformity.

    Which documents should a NIS2 or DORA supplier provide?

    Covered service, incident contacts, backup and test, privileged access, subcontractors and the latest contract review. The critical-supplier scenario lists them one by one.

    Are the ticks saved?

    No. They stay in the browser while the page is open. A durable register needs an evidence system, not this page.

    Does the oversight body use the CISO list?

    Partly. Oversight looks at protocols, reporting paths and proof the controls ran on sensitive processes. The Model 231 scenario isolates those items.