NIS2 is not a policy folder. Operators need runbooks for incident classification, 24h early warning, backup restore proof and supplier escalation — mapped to real systems, not generic "activate IR plan" steps.

Before pentest findings, auditors look at identity: MFA coverage, privileged access, joiner-mover-leaver and evidence that access matches role — not spreadsheet hope. Here is what they sample and how to prepare without buying another portal.