Evidence audit program for operators of critical facilities.
How to audit whether the risk management measures of an operator of critical facilities are implemented and evidenced so that the proof submitted to the Federal Office holds up.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether an operator of critical facilities has implemented the risk management measures for its critical facilities that go beyond the general level, whether attack detection systems are operated and whether reporting duties can be met. It also assesses whether the proof for the Federal Office through audits, inspections or certifications is prepared: scope, auditors, documentation and handling of deficiencies.
Scope
- Critical facilities of the operator and the IT systems, components and processes needed to run them
- Risk management measures under the general and the special requirements for operators of critical facilities
- Preparation and performance of the proof to the Federal Office
- Out of scope: physical resilience measures under the KRITIS umbrella act and sector-specific requirements, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | The operator’s critical facilities are determined and delimited; the IT systems, components and processes needed to run them are known and documented. | § 31(1) and (2) BSIG | Compare the delimitation of critical facilities and the list of associated systems with the system overview. | Documentation of critical facilities, system overview, dependency overview |
| 2 | A risk analysis with security concepts exists for the critical facilities; it is current and owned by management. | § 30(2) no. 1 BSIG; NIS2 Directive Art. 20 | Read the risk analysis and security concepts and check currency and approval by management. | Risk analysis, security concepts, management approval records |
| 3 | For the critical facilities the measures go beyond the general level and the effort is not disproportionate to the consequences of a failure. | § 31(1) BSIG | Check how the proportionality of measures for the critical facilities is justified and documented. | Justification of proportionality, catalogue of measures for the critical facilities |
| 4 | Attack detection systems are used that continuously and automatically collect and evaluate suitable parameters and identify ongoing threats. | § 31(2) BSIG | Review the systems, components covered and evaluation, and check coverage of the systems of the critical facilities. | Architecture of attack detection, coverage overview, evaluations |
| 5 | Measures for handling security incidents and for maintaining operations are implemented and exercised. | § 30(2) no. 2 and 3 BSIG | Read incident and continuity plans for the critical facilities and review the results of the last exercise. | Incident and continuity plans, exercise records |
| 6 | The supply chain of the critical facilities is considered; providers with access are bound by contract to security requirements. | § 30(2) no. 4 BSIG | Check contracts and assessments of three providers of the critical facilities. | Provider inventory, contracts, assessments |
| 7 | Access control and multi-factor authentication are implemented for the systems of the critical facilities. | § 30(2) no. 9 and 10 BSIG | Check authorisations and authentication for the systems of the critical facilities in a sample. | Authorisation extracts, configuration of multi-factor authentication |
| 8 | Concepts and procedures for assessing the effectiveness of the measures exist and are applied. | § 30(2) no. 6 BSIG | Review the effectiveness assessment procedure and the results of the last twelve months. | Audit plan, effectiveness assessment reports, action list |
| 9 | Significant security incidents can be reported to the joint reporting office: early warning within 24 hours, notification within 72 hours, final report after one month. | § 32(1) BSIG | Check the reporting process, responsibilities and templates, and examine a report or exercise for compliance with the deadlines. | Reporting process, templates, evidence of exercise or report |
| 10 | The proof to the Federal Office is planned: scope, type of proof (audit, inspection or certification), date within the three-year cycle and auditors are defined. | § 39(1) BSIG | Compare the proof planning with the date set by the Federal Office and check the suitability and independence of the audit body. | Proof planning, engagement of the audit body, notice of date from the Federal Office |
| 11 | Security deficiencies found are recorded with deadline and owner, tracked and demonstrably remedied towards the Federal Office. | § 39(1) BSIG | Review deficiency lists from earlier proofs and check the state of remediation. | Deficiency list, action plan, evidence of remediation |
Documents to request
- Documentation of the critical facilities and associated systems
- Risk analysis and security concepts
- Justification of the proportionality of measures
- Description of attack detection with coverage overview
- Incident and continuity plans with exercise records
- Reporting process with templates and responsibilities
- Proof planning and reports of earlier audits, inspections or certifications
- Deficiency list with action plan
Typical findings
- The delimitation of the critical facilities and the necessary IT systems is not current, and dependencies are not recorded.
- Attack detection does not cover part of the systems of the critical facilities.
- The proportionality of measures is not justified, and special measures for the critical facilities are not apparent.
- The ability to report has never been exercised, and deputies for the responsible people are not clarified.
- The proof is prepared too late, and the scope of the audit does not fully cover the critical facilities.
- Deficiencies from earlier audits have no deadline or owner and are not tracked.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing