Different teams, speaking different languages, usually handle compliance and cybersecurity. However, when it comes to protecting corporate documentation, the two depend on each other: cybersecurity creates the controls, and compliance requires proof that those controls exist and work. As a result, an organisation that treats the two topics separately often ends up with controls without evidence, or evidence without controls.
In brief
- The GDPR, NIS2 and standards such as ISO/IEC 27001 require measures that match the risk, as well as the ability to demonstrate them.
- Documentation is both an asset to protect and the evidence that protection exists.
- A simple matrix that links each obligation to a control and a piece of evidence reduces audit effort and prevents gaps.
- Short incident notification deadlines make it essential to have information organised before an incident happens.
Compliance and cybersecurity: Why they converge
The most relevant legal and regulatory frameworks share a common logic. First, they require a risk assessment. Next, they call for measures proportionate to that risk. Finally, they require the organisation to demonstrate what it has done. Thus, compliance is no longer a list of documents and instead depends on how effective the security controls really are, while cybersecurity now has to produce verifiable evidence.
| Framework | Main focus | What it requires you to demonstrate |
|---|---|---|
| GDPR | Personal data protection | Appropriate technical and organisational measures, records of processing activities and data breach management |
| NIS2 and the Portuguese national cybersecurity legal framework | Security of the networks and information systems of covered entities | Risk management, minimum measures, supply chain security and incident notification |
| ISO/IEC 27001 | Information security management system | Policies, applicable controls, monitoring, internal audits and continual improvement |
Documentation as an asset and as evidence
Corporate documentation plays a dual role. On the one hand, it contains valuable and sensitive information: contracts, worker data, and technical and financial information. On the other hand, it is the evidence that the organisation meets its obligations: approved policies, training records, risk assessments, access logs and incident reports.
A security failure in the document platform therefore has a double effect. In addition to exposing information, it can undermine the organisation’s ability to demonstrate compliance, precisely when it needs it most.
From obligation to evidence: A simple matrix
The most effective way to link compliance and cybersecurity is a matrix that connects each obligation with the control that fulfils it and the evidence that demonstrates it. For example:
| Obligation | Control | Evidence |
|---|---|---|
| Ensure data confidentiality | Access profiles and multi-factor authentication | List of profiles, report of accounts with strong authentication, annual access review |
| Ensure availability | Backups and restore tests | Backup logs and restore test reports |
| Detect and respond to incidents | Audit logs, alerts and response procedure | Records of handled alerts and incident reports |
| Control suppliers | Contractual security requirements and periodic assessment | Contracts, questionnaires and validated evidence |
| Raise staff awareness | Regular information security training | Training records and exercise results |
So, when an audit comes round, the question is no longer “what do we have?” but “where is the evidence for each line?”. In addition, the matrix quickly reveals obligations without controls or controls without evidence.
Incidents: When time matters
As a rule, the GDPR requires organisations to notify personal data breaches to the supervisory authority within 72 hours of becoming aware of them. Similarly, NIS2 provides for an early warning within 24 hours for significant incidents at covered entities. In both cases, the organisation needs to know quickly which information the incident affected, who it belongs to and which measures were in place.
That is why preparation makes the difference: an information inventory, searchable access logs and a tested response procedure make it possible to meet short deadlines without improvising. On the contrary, when documentation sits in scattered places, teams lose the first hours trying to work out what happened.
Suppliers count too
A significant share of incidents comes in through third parties: contractors with system access, platforms provided as a service and subcontractors that process data. Therefore, the organisation’s compliance depends partly on the security of its suppliers. For this reason, contracts should include security and incident notification requirements, and the organisation should be able to show that it has assessed its most critical suppliers.
Example: A client audit
An energy operator that falls under NIS2 sends a technical service provider a twenty-question security questionnaire and asks for evidence within two weeks. Among other items, it requests the information security policy, the list of employees with access to the client’s systems, the security training records and the incident notification procedure.
Without prior organisation, the provider spends the two weeks searching for documents in emails and folders and, even so, delivers incomplete answers. By contrast, with the matrix of obligations, controls and evidence, and with centralised documentation, the response takes a few days and is consistent. In this way, compliance becomes a commercial advantage: the provider becomes easier to qualify and more reliable in the client’s eyes.
The role of the document platform
A well-configured document management platform helps with both sides of the problem. On the one hand, it protects information through profiles, authentication, encryption and backups. On the other hand, it organises evidence through versions, expiry dates, approvals and access history. Furthermore, it lets you link each document to the requirement it demonstrates, which makes it easier to answer audits and questionnaires without rebuilding information every time.
However, the platform does not replace the organisation’s decisions. Management still defines the policies, profiles and retention periods, with support from the legal, IT and security teams.
Common mistakes
- Policies without practice. An approved policy that nobody applies will not withstand a serious audit.
- Controls without records. Even if the organisation does what it should, it cannot prove it.
- Keeping everything indefinitely. Storing logs and documents with no time limit increases risk and goes against the storage limitation principle.
- Treating compliance as a one-off project. Compliance requires ongoing monitoring, because risks and obligations change.
Where to start
- Identify the applicable obligations. First, confirm whether NIS2 applies to the organisation and which personal data processing it carries out.
- Take stock of critical information. Next, find out where it is, who accesses it and what protection it has.
- Build the matrix. Link each obligation to a control and a piece of evidence, starting with the most relevant ones.
- Centralise the evidence. Bring compliance documentation together in a platform with permissions, history and expiry dates.
- Test. Finally, simulate an audit or an incident and check whether the evidence turns up in the time required.
In short, there is no need to start with a large project. On the contrary, a matrix with the ten most relevant obligations, their controls and the evidence that already exists gives you, within a few weeks, a clear view of what is already in place and what is missing. Later, the organisation can gradually extend the matrix as new obligations, new clients or new risks arise.
Frequently asked questions
NIS2 does not apply to my company. Does this still apply?
Yes, to a large extent. The GDPR applies to almost every organisation and, in addition, clients that fall under NIS2 will ask their suppliers for security evidence.
How long should we keep access logs?
For a defined period that the purpose justifies, for example incident investigation or specific legal obligations. The policy should therefore set that period, instead of keeping logs indefinitely.
Who should be responsible for the compliance matrix?
In general, a coordinating function, such as the compliance, quality or information security team, with input from the other areas. However, each control should have a named owner, responsible for keeping the evidence up to date.
Questions for senior management
- Can we show the evidence for each relevant security control within a few hours?
- Do we know which suppliers have access to our most sensitive information?
- Have we tested, in the last year, our ability to respond to an incident within the legal deadlines?
Conclusion
In summary, compliance and cybersecurity in documentation are two sides of the same goal: protecting information and being able to prove it. Consequently, organisations that link obligations, controls and evidence in a simple structure spend less time on audits, respond better to incidents and give clients and partners more confidence.
AISP-GEDOC supports companies in organising their compliance documentation and in document management on digital platforms with permissions, history and expiry date control.
See also: Access control and cybersecurity in document management and Compliance and GDPR in 2026: From intention to operational proof.
Sources