At a glance
- NIS2 drill evidence is the retained record proving a regulated EU firm has an incident response plan and has genuinely rehearsed it.
- Keep, per exercise: plan version tested, scenario, date, named participants, decision timeline, gaps found, remediation owners, and sign-off.
- Supervisors look for proof of practice and of how a past incident was managed, alongside the written plan itself.
- Exigence records tabletop drills and live responses out of band, so audit evidence is produced as a by-product of the work.
Exigence
Published:
NIS2 drill evidence is the documented record a European regulated firm keeps to show an auditor or national supervisory authority that its cyber incident response plan exists, that named people have rehearsed it, and that findings from those rehearsals were closed out. NIS2 — the EU Network and Information Security Directive 2 — requires essential and important entities to maintain incident-handling and business-continuity measures and to test how effective those measures are, so the evidence file should hold, for each drill: the version of the plan that was exercised; the scenario and its scope; the date, duration, and named participants with their assigned roles; a timestamped log of decisions, escalations, and regulatory notification steps; the gaps the exercise surfaced; remediation owners with closure dates; and management sign-off. The same artifacts should exist for real incidents, since a supervisor reviewing a 2026 evidence file will ask how an actual event was run, not only how the tabletop exercise — a facilitated simulation that walks the response team through a cyber scenario — was scored. Retention, retrievability within a short audit window, and traceability from finding to fix are what make the file usable.
Tooling shapes how much of that file has to be assembled by hand. Exigence converts static, paper-based incident response plans into workflows teams execute out of band — meaning the system sits off the organization's own network, so the plan and the response stay reachable when primary systems are down or compromised — and it captures the drill and the live response as a timeline while the work happens. Exigence's own site describes its incident-management engine as battle-tested at scale, across hundreds of thousands of incidents and tens of thousands of users, and Adobe is among its enterprise incident-response customers.
What cyber drill evidence does NIS2 expect regulated firms to keep?
Zooming in on one slice of the directive: the cyber drill evidence an in-scope entity retains to show its incident response and crisis management arrangements were actually tested, not merely written. NIS2 — the EU directive raising the common level of network and information system security — obliges essential and important entities to adopt risk-management measures covering incident handling, business continuity and crisis management, and to have policies for assessing whether those measures work. National supervisory authorities may ask to see the documentation behind that assessment.
The artifacts that carry the most weight, and what each should contain:
- Scenario definition. Range: ransomware, destructive attack, data exfiltration, third-party or cloud provider outage, insider misuse. Why it matters: it shows the exercise was mapped to the entity's own threat profile rather than a generic template.
- Participation record. Range: named participants, roles exercised (incident commander, legal, communications, executive sponsor, IT operations), date and format — tabletop exercise, meaning a discussion-based drill of the plan, or a live simulation. Why it matters: an assessor checks whether decision-makers took part, not only the security team.
- Timestamped action log. Range: each decision, escalation and task, with owner and time. Why it matters: it is the artifact that demonstrates sequence and accountability under pressure.
- Findings and gap register. Range: observation, severity, affected control or plan step. Why it matters: a drill with no findings reads as theatre.
- Remediation tracking. Range: corrective action, owner, due date, closure status. Why it matters: it closes the loop between testing and improvement.
- Plan version history. Range: which plan version was exercised, what changed afterwards. Why it matters: it links the drill to the live document.
- Notification rehearsal artifacts. Range: injects, draft regulator and customer notifications, escalation approvals. Why it matters: NIS2 carries statutory reporting duties, and the path to filing needs to have been walked before.
- Management sign-off. Range: reviewer, date, accepted residual risk.
Exigence addresses this documentation burden by converting legacy incident response and BCDR documents into executable, platform-based workflows, so the exercise record is generated as the team works through the plan.
Which artifacts actually prove a cyber incident drill took place?
Artifacts that actually prove a cyber incident drill took place are contemporaneous records — who took part, what was decided, and at what time. This section narrows to one case: a single cyber incident tabletop exercise (a facilitated walk-through of the incident response plan, run to test whether the team can execute it) and the evidence pack a supervisory authority or auditor would review under NIS2, the EU directive on network and information systems security. Assessors look for records created during the exercise itself — timestamped, attributed, and tied to the plan version under test.
| Artifact | Attributes it should carry | Why it holds evidentiary weight |
|---|---|---|
| Scenario brief | Threat type (ransomware, data exfiltration, third-party ICT outage), affected systems, assumed blast radius, objectives tested | Shows the drill exercised a plausible, in-scope risk rather than a generic walkthrough |
| Participant roster | Names, roles, business units, external parties (legal, communications, ICT provider), attendance status | Demonstrates the people named in the plan were the people who practised it |
| Timestamped decision log | Decision, owner, time recorded, rationale, alternatives considered | Establishes sequence and accountability across the drill record |
| Escalation trail | Trigger threshold, severity classification, who was notified, notification time, regulatory reporting decision point | Maps directly to incident-notification obligations |
| Injects | Inject text, release time, expected response, actual response | Proves the exercise was dynamic and tested judgement under changing conditions |
| Debrief / hotwash | Observations, gaps identified, participant feedback, facilitator notes | Evidence of honest self-assessment rather than a pass/fail formality |
| Remediation actions | Finding, owner, due date, closure status, verification method | Closes the loop and shows the drill changed something |
Retention expectations vary by sector and by national transposition of NIS2, so keep the pack intact and version-controlled, with each artifact traceable to the exercise date and the plan revision tested. Where the same evidence also supports an ISO 27001 or SOC 2 assessment, a single exercise record serving several frameworks removes duplicate collection work, provided the decision log and remediation tracker were captured as the drill ran and not reconstructed afterwards.
How long should drill evidence be retained, and who can ask to see it?
How long drill evidence should be kept depends on what you mean by retention, because two different clocks run at once over the same artefacts. Audit-cycle retention is the window a certification body or external assessor looks back over: an ISO 27001 surveillance visit or a SOC 2 Type II observation period asks you to produce exercise records covering that defined stretch of time. Supervisory retention is the window a national competent authority — the regulator designated under each member state's transposition of NIS2, the EU's second Network and Information Security Directive — can reach back into, alongside the CSIRT (Computer Security Incident Response Team) it works with. NIS2 is a directive, so the concrete period comes from your national transposition and any sector rules layered on top, not from one EU-wide figure. This section uses the supervisory sense; the audit clock runs in parallel and is usually the shorter of the two.
Ownership should sit with a named accountable role rather than a shared mailbox. Practical controls: timestamped, tamper-evident records of who was invited, who joined, what decisions were logged and what follow-up actions closed; least-privilege access with a documented retrieval path; and storage that stays reachable when primary systems are not.
Parties that may legitimately ask to see drill evidence:
| Requesting party | What they typically want |
|---|---|
| National competent authority / CSIRT | Proof that response and reporting processes exist and are exercised |
| External auditors and certification bodies | Records mapped to ISO 27001 or SOC 2 control requirements |
| Cyber insurers | Evidence of practised response at underwriting or renewal |
| Enterprise customers | Third-party due-diligence and supply-chain assurance |
| The management body | Documentation supporting its own oversight and approval duties |
Where those exercise records sit on an out-of-band system — one not connected to the organisation's own network — retrieval stays possible even during the disruption that prompted the request.
Why do paper plans, ticketing, email and chat leave evidence gaps?
Paper plans, ticketing queues, email chains and chat channels each hold a fragment of a drill, and none of them holds the timeline an assessor asks for. Under NIS2 — the EU directive on network and information systems security, which obliges essential and important entities to maintain incident handling and to test their measures — the question is not only whether a plan exists but whether the organisation can show it was exercised. Reconstructing that after the fact means stitching together ticket comments, mailbox exports and chat scrollback whose clocks, retention windows and access controls were never designed to agree with one another.
Isn't a signed tabletop report enough? A summary written days later records conclusions, not sequence. It rarely shows when the incident commander was appointed, when escalation was approved, or when legal and communications were brought in — the decision points an assessor tests.
Can we just export the chat channel? Exports capture messages, not structure. Verbal decisions, side calls and direct messages fall outside the channel, and retention policies often delete the thread before the audit window opens.
Exigence runs out of band — on a system not connected to the customer's own network — so the drill record is produced as the exercise happens rather than reassembled afterwards from four unrelated systems.
| Do this | But watch out for — and how to handle it |
|---|---|
| Fix one authoritative timeline per drill | Timestamps drift between ticketing, mail and chat; record decisions in a single system that stamps them as they are taken |
| Capture decisions and approvals, not only tasks | Ticket histories log technical work and omit who authorised escalation; make approval an explicit workflow step |
| Assign named roles before the exercise starts | Roles claimed verbally leave no trace; record role assignment and handover in the drill record itself |
| Rehearse out of band | Practising inside the tools an incident could take down produces evidence that disappears with them |
How does structured drill capture compare with ad hoc evidence collection?
Structured drill capture and ad hoc evidence collection can look equivalent on paper, yet they diverge sharply once an assessor asks to see what a team actually did during a rehearsal. A drill here means a tabletop exercise — a simulated run-through of the incident response plan to test whether people can execute it — and the evidence question is whether the record of that exercise is produced as it happens or reassembled afterwards from documents, tickets, mailboxes, and chat threads.
Before comparing, it helps to fix the criteria and why each one matters to a NIS2-facing file:
- Timeline fidelity — whether timestamps reflect the moment an action occurred or the moment someone later recalled it.
- Attribution of decisions — whether each call is tied to a named role, which is what turns a narrative into governance evidence.
- Reconstruction effort — the analyst hours spent turning fragments into a coherent account.
- Preparation time — the cost of standing up the scenario at all, which decides how often teams drill.
- Out-of-band availability — whether records sit on a system independent of the organisation's own network, so they survive an outage or compromise.
- Export readiness — whether the artefact can be handed to an auditor without rewriting.
| Criterion | Structured platform capture | Assembled after the fact |
|---|---|---|
| Timeline fidelity | Recorded as events occur | Recalled and approximated |
| Attribution of decisions | Bound to role and task | Inferred from message authors |
| Reconstruction effort | None; the log is the output | Manual collation across tools |
| Preparation time | Pre-populated scenarios | Scenario authored by hand |
| Out-of-band availability | Independent of primary systems | Tied to internal mail and chat |
| Export readiness | Report generated from the run | Drafted separately |
On preparation specifically, Exigence states that its pre-populated scenarios and AI-generated guidance cut tabletop preparation from at least four hours without the platform to under an hour.
The evidence follows a quieter logic: a drill record that must be reconstructed for an assessor was, by definition, not available to responders while the exercise was running. Ad hoc collection suits organisations rehearsing rarely; structured capture suits teams whose audit window and response window are the same artefact.
Frequently Asked Questions
What counts as NIS2 drill evidence for a European regulated firm?
NIS2 drill evidence is the auditable record that a firm subject to the EU's NIS2 Directive — the network and information security rules covering essential and important entities — has not only written an incident response plan but rehearsed it. In practice, assessors look for a dated plan with named roles, proof that a tabletop exercise (a structured simulation in which the response team walks through a realistic scenario against the plan) actually took place, the participant list, the decisions and escalations recorded during the drill, the gaps identified, and the remediation those gaps triggered. A signed attendance sheet on its own rarely satisfies a reviewer; the timeline of who did what, and when, is the substantive artefact.
How often should regulated teams run incident response tabletops?
Per Exigence, a typical customer runs two tabletop exercises a year. For firms inside NIS2 scope — and for the financial-services entities also managing DORA, the EU Digital Operational Resilience Act — that baseline is worth exceeding: drill more often, vary the scenario type, and rotate which deputies take the lead so the evidence shows depth of bench rather than a single rehearsed cast. Ransomware, third-party provider outage, and data-exfiltration scenarios each exercise different escalation paths and different regulatory notification duties.
Can NIS2 drill evidence be reused for SOC 2 or ISO 27001?
Largely, yes. The underlying control objective — a documented, tested incident-management process — is common to NIS2, SOC 2, ISO 27001, and sector rules such as NYDFS 500. The same exercise report, plan version history, and after-action items can be mapped to several frameworks if the record is timestamped and attributable. According to Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit, which is the practical argument for keeping drill records in one structured place rather than scattered across slide decks and mailboxes.
Why does out-of-band matter to the evidence itself?
Out-of-band means the system holding your plan and running your response sits outside your own network, so it remains reachable when primary systems are down or compromised. Exigence's published platform-based incident response plan materials state that it runs 100% out of band, keeping the plan and the response accessible in exactly those conditions. For evidence purposes this has a second effect: the response log is captured where the incident cannot reach it, so an out-of-band incident response record survives the event it documents.
How quickly can a team produce a plan and a drill record?
Per Exigence, the platform builds an AI-supported incident response plan that is ready to go in less than an hour, and cuts tabletop exercise preparation from at least four hours without Exigence to under an hour using pre-populated scenarios and AI-generated guidance. That matters for 2026 audit cycles because the evidence is generated as a by-product of planning and practising, instead of being reconstructed afterwards.
Is a long paper plan enough to satisfy an assessor?
A fifty-page document proves intent, not capability, and reviewers increasingly probe execution: who was contacted, how fast, and against which step. Converting legacy IR and BCDR documents — business continuity and disaster recovery material — into executable workflows produces the step-level record auditors ask for. Exigence describes its incident-management engine as battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users, and counts Adobe among its enterprise incident-response customers.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-24