OTCOGNISHIELD / ENGINEERING GUIDE
NIS2 OT evidence preparation for smaller plant teams
A practical record structure for OT monitoring evidence and accountable review.
Published 4 November 2026 · OTCogniShield engineering notes
FOR BUSINESS LEADERS
Business value
Organise OT observations into a record that a responsible reviewer can inspect and understand.
What to ask
Who owns the review, what is in scope, when was evidence collected, and what remains unresolved?
Important boundary
Evidence preparation supports the appropriate assessment. This guide does not determine legal applicability or certify compliance.
| Purpose | Evidence preparation; no compliance determination |
|---|---|
| Illustrative references | NIS2 Article 21(2)(a) and (b) |
| Required context | Organisational scope, applicable national requirements and owner review |
Start with an evidence question
For a plant team, a useful starting question is: which assets and communications support the operation, what was observed, and who reviewed the next step? A retained record should answer that question without requiring the reader to reconstruct several unrelated screens.
NIS2 Article 21 addresses cybersecurity risk-management measures. Its paragraph 2 includes policies on risk analysis and information-system security, and incident handling. Local monitoring records can support an evidence discussion around these subjects; a monitoring product cannot establish that an organisation has met all its obligations.
Keep observation and assessment separate
Preserve source identifiers, observation time, available endpoints, parser or rule context, evidence limitations and the reviewer's action. Record unknown values explicitly. Add the asset owner's explanation and any approved maintenance context as separate review information, without overwriting the original observation.
For exports, identify the selected scope, generation time and format. A snapshot checksum can help a recipient check whether that snapshot changed. It does not establish the origin of a packet, the legitimacy of a command or the completeness of monitoring coverage.
Prepare a reviewable pack
- State the systems and time period covered.
- Explain collection boundaries, gaps and freshness.
- Include the observed record and accountable review action.
- List the illustrative framework reference and the remaining evidence needed.
- Retain owner approval and agreed follow-up separately.
Applicability, national implementation and legal interpretation require appropriate review. OTCogniShield supports preparation; it provides no certification or legal conclusion through an export.