KR eCampusCourses coming soon

KR ECAMPUS

Choose your country

Select your country to switch to the right eCampus site.

My eCampus

Back to courses

Advanced · Self-paced learning

Managing Assurance Evidence for Critical Infrastructure

Inquiry This course is not yet bookable.

A critical infrastructure review has a policy, records and certificate, but none shows that the control operated at the site under review. Establish what the documents support and request the missing evidence.

Define the review scope and map records to the required assertions. Record gaps and ownership in an evidence register. When a dated site test result arrives, assess what it shows, update the register and prepare the records for handover. Work with an approved area from your organisation or a case study.

Your completed register shows what is supported and which requests remain open. The evidence required depends on the review engagement and applicable requirements.

What you will work on

  • You define the review scope and evidence requirements for a defined part of your organisation in a traceable way.
  • You map existing evidence to the statements and accountable roles, and identify gaps.
  • You check a policy, certificate and record for evidence about the specific site.

Who it is for

  • Information security officers and security managers
  • Audit and assurance coordinators
  • Operators of critical infrastructure with review and reporting obligations

Topics

  • Clarifying the review case, scope and evidence requirements
  • Distinguishing evidence types, what the evidence shows and how current it is
  • Building an evidence register and assigning accountability
  • Action status: substantiated, asserted or open
  • Audit handover and evidence gaps
  • Escalation and updating after a changed situation

Your result

Your evidence register records required assertions, site evidence, gaps and requests. Use it to prepare the audit handover.

Prerequisites

Experience in security, compliance or audit work, and access to evidence repositories, action lists and accountable roles for a defined area. Where approved company information is unavailable, an anonymised case or case study is used. Familiarity with the German or EU regulatory context is helpful; the course does not provide a legal assessment of your obligations.

Format and approach

Planned: 8–10 hours of self-study, with templates and explanatory self-checks.

Regulatory scope: Germany.

Planned learning time: 8–10 hours

Enquire about this course

Advanced · Self-paced learning

Managing NIS2 Implementation

Two areas report the same recovery status. In one, the test worked but its record is missing; in the other, a plan exists but the test failed. Distinguish the gaps and record the tasks and dependencies for NIS2 implementation on an action board.

Read the description