Supervision is a duty on the competent authority, but it lands on the entity as a set of things it must be able to submit to and produce. Essential entities are subject to both ex ante and ex post supervision, important entities to ex post supervision triggered by evidence of an infringement. In either case the measures include on-site inspections and off-site supervision, targeted security audits based on risk assessment, ad hoc audits after a significant incident or where non-compliance is indicated, security scans, requests for information needed to assess the risk-management measures, requests for access to data, documents and information, and requests for evidence of implementation of the entity's cybersecurity policies including audit results and their underlying evidence. Audit results must be made available to the authority, and the cost of a targeted audit performed by an independent body is normally borne by the audited entity. Enforcement can go on to binding instructions, ordered implementation of audit recommendations, a designated monitoring officer and, for essential entities, temporary suspension of a certification or of a senior individual's management functions. Readiness is therefore evidential: the entity must be able to produce the underlying evidence, not a summary of it.
NIS2 Directive Art.32 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.