Cybersecurity audit: how to choose an auditor for NIS2 and ISO 27001

In short: choose a cybersecurity auditor based on three things. First, whether they can perform the audit according to the NKSC-approved methodology and are independent of your IT providers. Second, whether they have experience in your sector. Third, whether after the audit you get not only findings but also a prioritised action plan. For NIS2 entities an audit is mandatory at least once every 3 years, so the auditor often becomes a long-term partner.

When an audit is mandatory and when it is simply useful

Under the Lithuanian Cybersecurity Law, which transposes the NIS2 Directive, entities included in the NKSC register must carry out a cybersecurity audit at least once every 3 years. It must be performed by independent certified auditors according to the NKSC-approved audit methodology. In addition, a compliance assessment must be carried out every year, together with a remediation plan.

If your company is not in the register, an audit is still often needed: clients, banks, insurers or investors ask for it. In that case an audit lets you demonstrate alignment with ISO/IEC 27001 or NIS2 requirements, even if you are not obliged to apply them.

A NIS2 audit and ISO/IEC 27001 are not the same

• A NIS2 (Cybersecurity Law) audit assesses whether the organisational and technical requirements set by law have been implemented. Its report may be required during an NKSC inspection.
• An ISO/IEC 27001 certification audit is performed by an accredited certification body, and the result is a certificate. It is a voluntary standard, but its controls largely overlap with NIS2 requirements.
• An internal or readiness (gap) audit shows how far you are from compliance before an external auditor or NKSC arrives.

Before choosing an auditor, be clear about which audit you need. Both the auditor’s qualifications and the price depend on it.

7 questions worth asking an auditor

1. Are you independent of our IT providers? An auditor should not assess systems they have implemented or maintain themselves.
2. Which methodology will you apply? For NIS2 entities the audit must follow the NKSC methodology; for an ISO audit, the requirements of the standard.
3. What experience do you have in our sector? Risks differ between energy, finance and manufacturing companies.
4. What exactly will we receive? Ask for a sample report: does it include a management summary, risk levels and a concrete action plan?
5. Will you assess only documents, or actual practice too? A good audit checks evidence: access reviews, backup restore tests, the incident log.
6. How long will it take and what will you need from us? Find out how much staff time will be needed for interviews and collecting evidence.
7. Will you help after the audit? It matters that you can discuss the findings and verify whether the gaps have been closed.

Common mistakes when choosing an auditor

• Choosing on price alone. A cheap audit often means a questionnaire-based check without evidence – it will not help during an NKSC inspection.
• The audit is performed by the IT provider. This is a conflict of interest: the provider assesses its own work.
• The audit is ordered at the last minute. Before the technical requirements deadline (April 2027 for entities registered in April 2025), leave enough time to fix the gaps.
• Management is not involved. Under NIS2, management is responsible for cybersecurity measures, so the findings must be understandable to it as well.

How to prepare so the audit is faster and cheaper

Prepare a list of systems and providers in advance, gather current policies and procedures, and appoint one responsible person. If you have never assessed anything, start with a short readiness assessment – it will show whether it is worth inviting an external auditor straight away.

Frequently asked questions

Who is entitled to perform a NIS2 cybersecurity audit in Lithuania?

Independent certified auditors who meet the requirements of the NKSC audit methodology (independence, impartiality, qualifications). Before signing a contract, ask the auditor to confirm that they meet these requirements.

How often must an audit be carried out?

For NIS2 entities – at least once every 3 years. A compliance assessment is carried out every year.

Does an ISO/IEC 27001 certificate replace a NIS2 audit?

Not automatically. The controls largely overlap, so ISO makes preparation easier, but the NIS2 audit must be carried out according to the NKSC methodology.

AuraGroup performs independent cybersecurity and NIS2 readiness audits and helps prepare for ISO/IEC 27001. More about the cybersecurity audit or contact us – the first conversation is free.