What the auditor will ask for

Two different conversations hide behind the same question. A certification auditor checks a management system against a standard; a supervisory review checks whether you apply the measures the law requires. The lists overlap, but the language and the expected evidence differ - so we keep them apart.

Both lists include items Secvalis does not cover. A checklist that hides them would be useless before an actual audit.

ISO 27001 auditYou are preparing for a certification or surveillance audit by an external body.The list follows the evidence collected around technical vulnerability management (A.8.8) and the controls an auditor pulls alongside it.
NIS2 / KSC ActYour organisation falls under the Act and you need to show which security measures you apply.The list follows Article 21(2) of the NIS2 Directive, letter by letter, so nothing from the catalogue is missed.

Informational material, not legal advice. The list is indicative and not exhaustive — the scope of requests depends on the auditor, the certification body and the specifics of the organisation. It does not determine the reader's legal status or the outcome of an audit.