Frequently asked questions on frameworks, platform, services, data security and onboarding.
Short, verifiable answers. For specific cases, the starting assessment or the presentation go into detail.
Frameworks
How can an organisation tell whether NIS2 applies to it?
Three factors count: the sector of activity, which must fall within the annexes of NIS2 and of Legislative Decree 138/2024; size, normally medium-sized and above; and establishment in Italy. Some entities are in scope regardless of size, such as DNS service providers and certain public administrations. In Italy entities register on the ACN platform, which notifies inclusion and the category. The EVIDEVO starting assessment checks these factors against the organisation's profile.
What is the difference between an essential and an important entity?
The Art. 21 measures and the Art. 23 notification obligations are the same for both categories. Supervision differs: essential entities are subject to ex ante and ex post supervision, important entities to ex post supervision, triggered by indications of non-compliance. The maximum fines in the directive also differ: up to EUR 10 million or 2% of total worldwide annual turnover for essential entities, up to EUR 7 million or 1.4% for important entities.
What is the difference between ISO/IEC 27001 and NIS2?
NIS2 is an EU directive, transposed in Italy by Legislative Decree 138/2024: it is mandatory for entities in scope, with ACN supervision and fines. ISO/IEC 27001 is a voluntary standard setting the requirements for an information security management system, which an accredited body can certify. Many measures overlap, which is why ISO/IEC 27001 is a useful reference for structuring NIS2 measures. NIS2 adds its own obligations, such as notification of significant incidents and the responsibilities of the management body.
Is ISO/IEC 27001 certification mandatory?
No, no law requires it in general: it is voluntary. It is, however, often requested by customers, tenders and contracts, particularly from IT and cloud service providers. Certification does not amount to NIS2 compliance, but the management system and the evidence it produces cover a significant part of what NIS2 requires to be demonstrated.
What is SOC 2 and is it relevant to a European organisation?
SOC 2 is an attestation report issued by an independent auditor under AICPA standards, on a service organisation's controls against the Trust Services Criteria. It is not a certification and no European law requires it. It matters mainly to organisations selling services to customers who ask for it, often in North America. Organisations with an ISO/IEC 27001 system can reuse many of their controls; a Type II report, however, requires evidence across the whole observation period, usually three to twelve months.
Can an incident need to be notified under both NIS2 and the GDPR?
Yes. If a significant incident also involves a personal data breach, the two obligations apply together: an early warning to CSIRT Italia within 24 hours and a notification within 72 hours under NIS2 (Art. 23), and a notification to the data protection authority without undue delay and, where feasible, within 72 hours under the GDPR (Art. 33). Recipients, content and assessment criteria differ, so the two communications are prepared separately. The incident procedure should include both assessments from the moment of discovery.
Does a financial entity subject to DORA also have to apply NIS2?
NIS2 (Art. 4) provides that where a sector-specific EU act imposes requirements at least equivalent in effect, the provisions of that act apply. DORA is the sector-specific act for financial entities: ICT risk management, reporting of major ICT-related incidents, resilience testing and ICT third-party risk follow DORA. The same organisations may still be subject to other obligations, such as those under the GDPR.
What does the AI Act already require from organisations using AI systems?
Since 2 February 2025 the bans on prohibited AI practices and the AI literacy obligation (Art. 4) have applied: providers and deployers take measures to ensure that staff using AI systems have a sufficient level of AI literacy. The other obligations, including those on high-risk systems, apply in stages. The first step is an inventory of the AI systems in use, with the organisation's role and the risk class of each.
What responsibilities does the management body have under NIS2?
NIS2 Art. 20 requires management bodies to approve the risk-management measures and oversee their implementation, and makes them liable for infringements. Their members must follow security training. Demonstrating this requires approval resolutions, minutes of the meetings where the measures were reviewed and records of the training completed.
Platform
How does EVIDEVO calculate the status of a framework?
Frameworks are broken down into requirements, and each requirement is covered by one or more controls. Each control has an owner, a periodic test and the evidence that demonstrates it, with a validity date. The status of each framework is calculated from test results and evidence validity, not from statements.
Does EVIDEVO certify the organisation or attest to its compliance?
No. EVIDEVO does not issue certifications, audit reports or legal conformity opinions. It organises the work and evidence that lead to those outcomes, which remain the responsibility of certification bodies, auditors and authorities.
Where does the evidence come from?
Partly from connected systems: identity and access, cloud, devices, endpoint security, ticketing, development, human resources. EVIDEVO reads their configurations and lists, stores them as evidence with date and source and compares them with control parameters; if a parameter is not met, the test fails and the owner is alerted. Evidence that does not come from a system, such as minutes or contracts, is uploaded manually.
Can existing policies, controls and documents be reused?
Yes. During onboarding, existing policies, controls and evidence are imported into EVIDEVO, including from spreadsheets or other tools, without losing their history.
How does an external auditor work in the platform?
EVIDEVO generates the evidence package by framework and period, indexed by requirement. The auditor receives time-limited, read-only access restricted to the evidence requested. Questions and findings stay on record until closure, linked to controls and corrective actions.
How is artificial intelligence used?
Some features suggest links between requirements and controls, flag incomplete evidence or prepare drafts for review. Every suggestion shows the sources it is based on and is not applied without a person's confirmation; confirmations and rejections stay in the decision log. Customer data is not used to train models.
Is a consultant needed to use EVIDEVO?
No. EVIDEVO can be used in-house. Organisations that prefer support can work with the EVIDEVO team or a partner consultant, or hand compliance over to the EVIDEVO team. Consultants, vCISOs, auditors and MSPs serving several organisations use the Multi-client console, with an isolated space for each client.
Services
What is the difference between the starting assessment and a gap analysis?
The starting assessment is a high-level first look: it identifies the applicable frameworks, measures maturity area by area on five levels and sets out priorities with an effort estimate. A gap analysis goes further: it compares, measure by measure, what the framework requires with what is in place, down to the gaps and priorities for action. Neither replaces an audit or legal advice.
What does an EVIDEVO vCISO do?
An external security lead on an agreed engagement: the vCISO sets the programme and priorities and liaises with the management body and vendors. The vCISO works in the platform, so management body reports are generated from EVIDEVO data. Decisions on measures stay with the organisation and its management body.
Who carries out the internal audit?
Internal audits against NIS2 or ISO/IEC 27001 are carried out by the EVIDEVO team. The auditors are not the people who carried out the organisation's remediation, in line with the principle of audit impartiality. Findings and corrective actions are linked to controls in the platform.
Do the services include ISO/IEC 27001 certification?
No. The services prepare for certification: management system, statement of applicability, internal audit, management review and support during the audit. Certification is issued by the accredited body, which the organisation chooses.
Can an organisation that already works with a consultant use EVIDEVO?
Yes. Onboarding, assessment, remediation, vCISO and training can be delivered by partner consultants who use EVIDEVO with their own clients. An organisation referred by a consultant stays with that consultant.
Data security
Where is the data stored?
The application, database, files and backups are hosted in data centres in the European Union, with no transfers to third countries to deliver the service. Each customer's data is logically separated from the others and can be exported at any time.
What role does the EVIDEVO provider have under the GDPR?
For data entered by customers, the provider of EVIDEVO acts as a processor under Article 28 GDPR, on the basis of a data processing agreement. The list of sub-processors is available on request at [email protected].
What documentation is available for a vendor assessment?
The data processing agreement (DPA), the list of sub-processors, a description of the architecture and security measures, and answers to customer security questionnaires. Documentation is shared on request during the assessment.
How are access and data protected?
Access requires multi-factor authentication, and roles have distinct permissions for leads, owners, consultants and auditors. Data is encrypted in transit (TLS) and at rest, and every access to and change of sensitive data is logged. Daily backups are in place, with tested recovery procedures.
What happens to the data at the end of the contract?
The data can be exported in full at any time, including before the contract ends. At the end of the contract it is deleted within the terms agreed in the data processing agreement.
Pricing and onboarding
Is there a public price list?
No. The cost depends on the frameworks, the size of the organisation and the services chosen. An initial cost range is given during the presentation, followed by a written proposal setting out scope, onboarding timeline and cost range.
How does the presentation work?
After the request, the EVIDEVO team replies within one business day to agree the date and time. The meeting lasts thirty minutes: it starts from the frameworks in scope and how the work is organised today, then the platform is shown on an example close to the organisation's context. It also covers questions on data security.
Can an organisation start with an assessment before adopting the platform?
Yes. The starting assessment is currently carried out with an EVIDEVO specialist, who walks through the report and explains the priorities; a self-service version is being prepared. The profile gathered is the same one EVIDEVO uses to build controls, so it remains usable whichever route the organisation then takes.
How long does it take to get started?
The timing depends on the applicable frameworks and the starting point: the starting assessment estimates it.
A thirty-minute presentation based on the organisation's scope.
It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.