{"id":3840,"date":"2026-11-03T07:00:00","date_gmt":"2026-11-03T07:00:00","guid":{"rendered":"https:\/\/auragroup.lt\/?p=3840"},"modified":"2026-10-28T09:38:33","modified_gmt":"2026-10-28T09:38:33","slug":"kibernetinio-saugumo-auditas-kaip-pasirinkti-auditoriu","status":"publish","type":"post","link":"https:\/\/auragroup.lt\/en\/kibernetinio-saugumo-auditas-kaip-pasirinkti-auditoriu\/","title":{"rendered":"Cybersecurity audit: how to choose an auditor for NIS2 and ISO 27001"},"content":{"rendered":"

In short:<\/strong> choose a cybersecurity auditor based on three things. First, whether they can perform the audit according to the NKSC-approved methodology and are independent of your IT providers. Second, whether they have experience in your sector. Third, whether after the audit you get not only findings but also a prioritised action plan. For NIS2 entities an audit is mandatory at least once every 3 years, so the auditor often becomes a long-term partner.<\/p>\n

When an audit is mandatory and when it is simply useful<\/h2>\n

Under the Lithuanian Cybersecurity Law, which transposes the NIS2 Directive, entities included in the NKSC register must carry out a cybersecurity audit at least once every 3 years. It must be performed by independent certified auditors according to the NKSC-approved audit methodology. In addition, a compliance assessment must be carried out every year, together with a remediation plan.<\/p>\n

If your company is not in the register, an audit is still often needed: clients, banks, insurers or investors ask for it. In that case an audit lets you demonstrate alignment with ISO\/IEC 27001 or NIS2 requirements, even if you are not obliged to apply them.<\/p>\n

A NIS2 audit and ISO\/IEC 27001 are not the same<\/h2>\n