Resources
Practical guides, glossary and frequently asked questions on frameworks and compliance.
Reference material for those who run security and compliance: what the frameworks require, how evidence is organised, what the terms mean. Every guide lists its official sources and the date it was last updated.
Guides
Guides and checklists
-
NIS2 Art. 21(2): the ten minimum risk-management measures, letter by letter
What each of letters (a) to (j) of Article 21(2) of the NIS2 Directive requires, and what evidence organisations typically keep to demonstrate it. Includes the proportionality principles of Article 21(1) and the management body duties set out in Article 20.
Updated 4 October 2026Read → -
NIS2 Art. 23: reporting significant incidents, from the 24-hour early warning to the final report
When an incident is significant, which communications go to the CSIRT, within which deadlines and with what content. Includes a checklist for preparing the process before it is needed.
Updated 4 October 2026Read → -
Control, evidence, test, finding, exception: five GRC terms and how they differ
Working definitions of the terms used in audits and reviews, the difference between design and operating effectiveness, and why a policy alone does not show that a control works. With three examples: MFA, backup restore, vendor assessment.
Updated 4 October 2026Read → -
ISO/IEC 27001:2022: the Statement of Applicability, what it contains and where audits find issues
What clause 6.1.3 d) requires of the Statement of Applicability, how it links to risk assessment and treatment, the structure of Annex A 2022 and the most frequent audit findings. Includes a review checklist.
Updated 4 October 2026Read → -
Checklist: assessing a critical ICT vendor under NIS2 Art. 21, DORA Arts. 28-30 and GDPR Art. 28
The questions to put to a critical ICT vendor, grouped by area, and the NIS2, DORA and GDPR articles each area addresses. For pre-contract assessment and periodic review.
Updated 4 October 2026Read →
Glossary
Compliance terms, precisely defined.
41 terms, from the Statement of Applicability to the NIS2 early warning, with the legal reference where one exists.
- Accountability
- ACN (Italian National Cybersecurity Agency)
- Gap analysis
- Annex A (ISO/IEC 27001)
- Asset
- Internal audit
- Corrective action
- Business continuity
- Control
- CSIRT Italia
- Statement of applicability (SoA)
- DPIA (data protection impact assessment)
FAQ
Short answers to recurring questions.
30 questions on frameworks, platform, services, data security, pricing and onboarding.
All questions →News
Regulatory and EVIDEVO news.
Training
Training for management bodies, staff and teams.
NIS2 requires training for members of management bodies, and the AI Act requires a sufficient level of AI literacy among staff. The EVIDEVO team delivers the training, and attendance is recorded as evidence.
A thirty-minute presentation based on the organisation's scope.
It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.