In brief
During NIS2 supervision, URSIV checks whether the requirements are in place, implemented and demonstrable: the information security management system, risk management measures, reporting of significant incidents, the role of management and evidence of implementation. Documentation alone is not enough.
What does URSIV actually check during supervision?
During NIS2 supervision it is not enough for an organisation to show only policies and procedures. What counts is whether it can show that the requirements are in place, implemented and demonstrable.
This means above all: an information security management system, risk management measures, reporting of significant incidents, management involvement, clearly defined responsibilities, evidence of implemented measures and the ability to show the actual state quickly.
The biggest difference in practice: documentation alone is not enough. Supervision very quickly moves to the question of whether the organisation can show a record of decisions, the status of measures, evidence and the link between the legal requirements and actual implementation.
The core of supervision
NIS2 supervision checks whether the organisation actually meets its legal obligations, not just whether it has prepared formal documents.
Typically checked
- whether the organisation has correctly determined its status and obligations,
- whether there is a documented information security management system,
- whether risks are identified and managed,
- whether measures are actually implemented and not just written down,
- whether reporting of significant incidents is in place.
Where companies often fail
- documentation exists, but there is no evidence of implementation,
- there is no clear responsible person or owner of activities,
- the status of measures is not traceable,
- management is not involved, or this cannot be shown,
- the organisation cannot quickly show the actual state.
Which evidence matters most in practice
Supervision is much easier for an organisation whose evidence is structured and linked to responsibilities, deadlines and implementation status.
Policies and procedures
Not just documents, but also evidence that they have been reviewed, approved and used in practice.
Risk register
It must be clear which risks have been identified, how they are treated and who is responsible.
Status of measures
Supervision very quickly shows whether measures are actually under way, completed or exist only as a wish list.
Evidence of training
It matters that it is clear who was trained, when and in which area.
Evidence about incidents
If an incident occurred, it must be clear how it was handled, reported and closed.
Record of management decisions
For many questions, the key is whether you can show when management decided, what it approved and how it monitors the situation.
In practice: if during supervision you have to search for evidence in e-mails, spreadsheets and folders without a clear structure, you are already in a weaker position.
A particularly sensitive point: reporting significant incidents
NIS2 (Article 23) sets specific deadlines for notifying significant incidents. This is an area where non-compliance becomes visible very quickly.
Deadlines you must manage
- early warning no later than 24 hours after detection,
- incident notification no later than 72 hours after detection,
- final report no later than one month after the notification,
- where necessary also a progress report if the incident is still ongoing.
What supervision will be interested in
- whether the organisation can recognise and classify an incident,
- whether roles and responsibilities are clear,
- whether there is a record of the time of detection and response,
- whether the incident was correctly reported and documented.
The role of management during supervision
NIS2 does not place information and cyber security solely in the domain of IT. Supervision will also be interested in whether management actually supports and steers the area.
What “management involvement” means
- management is aware of the key risks,
- it takes decisions on priorities and measures,
- it supports the implementation of the management system,
- it can show that it monitors the area rather than ignoring it.
Why it matters
- supervision is not just a technical review,
- a lack of management support is hard to defend,
- without management there are often no clear priorities, deadlines or responsibilities.
What management often overlooks: during supervision it does not only matter whether “the team is doing something”, but whether it is also governed, approved, monitored and demonstrable.
What supervision usually looks like in practice
Although individual cases differ, the logic of supervision is usually quite predictable.
Establishing scope
First it matters whether the organisation has correctly determined its status and obligations.
Review of the system
Then the management system is checked: documentation, responsibilities, risks, measures and processes.
Review of evidence
The organisation must show that the system is not just designed but actually implemented.
Finding irregularities
If gaps are found, a decision with measures and deadlines for remedying them may follow.
Remedying irregularities
If the organisation acts quickly and credibly, its position is much better than with improvisation.
Ongoing compliance
Supervision is not a one-off event. What matters is the ability to manage the system in the long term.
Why preparing for supervision matters more than “nice documentation”
Two organisations can look similar on paper, but during supervision the difference is huge.
Bad scenario
- documents exist but are not linked to the actual state,
- the status of measures is unclear,
- there is no responsible person for individual activities,
- management has no overview,
- evidence is scattered and unconnected.
Good scenario
- requirements are mapped to specific measures,
- there is a register of evidence,
- statuses, deadlines and responsible persons are traceable,
- management has an overview of key decisions,
- the organisation can quickly show the actual state.
How Regulus Ai helps you prepare for supervision
The aim is not just to “have documentation”, but to reach a state that is defensible, traceable and usable during supervision. More on the service: NIS2 compliance.
1. Scope and status assessment
First we check the entity's status, category and the scope of obligations that must be managed.
2. Gap analysis
We identify the gaps with the greatest impact on supervision, demonstrability and regulatory risk.
3. Evidence management and audit trail
We set up a structure of evidence, a record of decisions, the status of measures and the link between requirements and actual implementation.
4. Preparation for the review
We help prepare the organisation so that, when asked to “show us”, it does not improvise but can show the state immediately.
The easiest supervision is the one you are ready for before it begins.
Book an initial consultationFrequently asked questions about supervision by URSIV
Does URSIV only check documentation?
No. Documentation is important, but on its own it is not enough. What counts is whether the organisation can also show the actual implementation of measures, responsibilities, task status and evidence.
What is the most common weakness of companies during supervision?
Most often, documents exist but there is no traceability of who approved what, what has been implemented, which measures are under way and where the related evidence is.
Does the role of management matter during supervision?
Yes. Supervision is interested not only in IT, but also in whether management supports and monitors the area and can show that it is involved in decision-making.
Does supervision always mean an immediate fine?
Not necessarily. The law also provides for corrective measures and deadlines for remedying irregularities. But the organisation is in a much better position if it can immediately show an organised system and progress.
Which evidence is most useful during supervision?
Usually structured evidence: approved policies, the risk register, the status of measures, evidence of training, evidence about incidents and a record of management decisions.
Does Regulus Ai also help with preparation for supervision?
Yes. We help with status assessment, gap analysis, preparing evidence, setting up evidence management and an audit trail, and preparing the organisation for the questions that typically arise during supervision.
Sources
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
Published: · Last updated: · Prepared by the Regulus Ai team
Don't let supervision take you by surprise
Regulus Ai helps you assess how ready your organisation is for supervision, where the biggest gaps are and which evidence to put in order first.