Comparison

NIS2 vs CPS 234

NIS2 Implementing Regulation (EU) 2024/2690 · APRA CPS 234 Information Security · data 2026-10-27

Requirement-level comparison of NIS2 Implementing Regulation (EU) 2024/2690 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have NIS2 → need CPS 234

24 reqs

23 mapped · · 1 no mapping Open in gap view →

Of 24 APRA CPS 234 Information Security requirements, 23 map to something in NIS2, 0 are only loosely related, and 1 have no mapping in our data.

CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.

Likely new work: CPS 234 requirements with no mapping to NIS2 (1)

CPS 234	Requirement	Match	NIS2	Evidence
Testing control effectiveness · 1
Para 29	Escalate deficiencies that can't be fixed quickly	No mapping in our data	—	No mapping to NIS2 in our data.

Mapped (23)

CPS 234	Requirement	Match	NIS2	Evidence
Roles and responsibilities · 2
Para 13	Board ultimately responsible for information security	Editorial	1.2 2.1 7.1	Same topic: Roles & Responsibilities, Risk Management (editorial pick)
Para 14	Define information security roles and responsibilities	Editorial	1.2	Same topic: Roles & Responsibilities (editorial pick)
Information security capability · 3
Para 15	Maintain a capability commensurate with threats	Editorial	2.1 7.1	Same topic: Risk Management (editorial pick)
Para 16	Assess third parties' information security capability	Editorial	5.1 5.2 6.1	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Para 17	Keep capability current as threats and vulnerabilities change	Editorial	2.1 6.5 6.10	Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick)
Policy framework · 2
Para 18	Maintain an information security policy framework	Editorial	1.1	Same topic: Governance Policy (editorial pick)
Para 19	Policies direct everyone with security obligations	Editorial	1.1	Same topic: Governance Policy (editorial pick)
Information asset identification and classification · 1
Para 20	Classify information assets by criticality and sensitivity	Editorial	12.1 12.4	Same topic: Data Classification, Asset Management (editorial pick)
Implementation of controls · 2
Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	2.1 12.2 12.3	Same topic: Risk Assessment, Data Protection (editorial pick)
Para 22	Evaluate the design of third parties' controls	Editorial	5.1 5.2 6.1	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Incident management · 4
Para 23	Detect and respond to incidents in a timely manner	Editorial	3.1 3.2 3.5	Same topic: Incident Response, Intrusion Detection (editorial pick)
Para 24	Maintain information security response plans	Editorial	3.1 3.5	Same topic: Incident Response (editorial pick)
Para 25	Response plans cover all stages and escalation	Editorial	3.1 3.5 3.6+1	Same topic: Incident Response, Lessons Learned (editorial pick)
Para 26	Review and test response plans annually	Editorial	3.1 3.5	Same topic: Incident Response (editorial pick)
Testing control effectiveness · 4
Para 27	Systematic testing programme for control effectiveness	Editorial	2.1 6.5 6.10+1	Same topic: Risk Management, Vulnerability Mgmt (editorial pick)
Para 28	Check third parties' control testing is adequate	Editorial	5.1 5.2 6.1	Same topic: Vendor Risk Mgmt (editorial pick)
Para 30	Testing by skilled, functionally independent specialists	Editorial	6.5 6.10	Same topic: Vulnerability Mgmt (editorial pick)
Para 31	Review the testing programme at least annually	Editorial	2.1 7.1	Same topic: Risk Management (editorial pick)
Internal audit · 3
Para 32	Internal audit reviews control design and effectiveness	Editorial	2.2 2.3	Same topic: Compliance (editorial pick)
Para 33	Assurance provided by appropriately skilled personnel	Editorial	2.2 2.3	Same topic: Compliance (editorial pick)
Para 34	Internal audit assesses third-party assurance relied on	Editorial	2.2 2.3 5.1+2	Same topic: Compliance, Vendor Risk Mgmt (editorial pick)
APRA notification · 2
Para 35	Notify APRA of material incidents within 72 hours	Editorial	3.3	Same topic: Reporting (editorial pick)
Para 36	Notify APRA of material control weaknesses within 10 business days	Editorial	3.3	Same topic: Reporting (editorial pick)

Have CPS 234 → need NIS2

49 reqs

21 mapped · · 22 no mapping Open in gap view →

Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 21 map to something in CPS 234, 6 are only loosely related, and 22 have no mapping in our data.

NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.

Likely new work: NIS2 requirements with no mapping to CPS 234 (22)

NIS2	Requirement	Match	CPS 234	Evidence
4. Business continuity and crisis management · 2
4.1	Business continuity and disaster recovery plan	No mapping in our data	—	No mapping to CPS 234 in our data.
4.2	Backup management	No mapping in our data	—	No mapping to CPS 234 in our data.
6. Security in acquisition, development and maintenance · 4
6.3	Configuration management	No mapping in our data	—	No mapping to CPS 234 in our data.
6.4	Change management, repairs and maintenance	No mapping in our data	—	No mapping to CPS 234 in our data.
6.6	Security patch management	No mapping in our data	—	No mapping to CPS 234 in our data.
6.8	Network segmentation	No mapping in our data	—	No mapping to CPS 234 in our data.
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	No mapping in our data	—	No mapping to CPS 234 in our data.
8.2	Security training	No mapping in our data	—	No mapping to CPS 234 in our data.
10. Human resources security · 4
10.1	Human resources security	No mapping in our data	—	No mapping to CPS 234 in our data.
10.2	Verification of Background	No mapping in our data	—	No mapping to CPS 234 in our data.
10.3	Termination or change of employment procedures	No mapping in our data	—	No mapping to CPS 234 in our data.
10.4	Disciplinary process	No mapping in our data	—	No mapping to CPS 234 in our data.
11. Access control · 7
11.1	Access control policy	No mapping in our data	—	No mapping to CPS 234 in our data.
11.2	Management of access rights	No mapping in our data	—	No mapping to CPS 234 in our data.
11.3	Privileged accounts and system administration accounts	No mapping in our data	—	No mapping to CPS 234 in our data.
11.4	Administration systems	No mapping in our data	—	No mapping to CPS 234 in our data.
11.5	Identification	No mapping in our data	—	No mapping to CPS 234 in our data.
11.6	Authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
11.7	Multi-factor authentication	No mapping in our data	—	No mapping to CPS 234 in our data.
12. Asset management · 1
12.5	Deposit, return or deletion of assets upon termination of employment	No mapping in our data	—	No mapping to CPS 234 in our data.
13. Environmental and physical security · 2
13.2	Protection against physical and environmental threats	No mapping in our data	—	No mapping to CPS 234 in our data.
13.3	Perimeter and physical access control	No mapping in our data	—	No mapping to CPS 234 in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (6)

NIS2	Requirement	Match	CPS 234	Evidence
3. Incident handling · 1
3.4	Event assessment and classification	Loosely related	Para 23 Para 24 Para 25+1	Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
6. Security in acquisition, development and maintenance · 3
6.2	Secure development life cycle	Loosely related	Para 20	Only shares CSF ID.AM-08: related, not a mapping
6.7	Network security	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
6.9	Protection against malicious and unauthorised software	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
9. Cryptography · 1
9.1	Cryptography	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
13. Environmental and physical security · 1
13.1	Supporting utilities	Loosely related	Para 34 Para 16 Para 22+3	Only shares CSF DE.CM-06, GV.OC-03, ID.RA-10: related, not a mapping

Mapped (21)

NIS2	Requirement	Match	CPS 234	Evidence
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	Editorial	Para 18 Para 19	Same topic: Governance Policy (editorial pick)
1.2	Roles, responsibilities and authorities	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
2. Risk management policy · 3
2.1	Risk management framework	Editorial	Para 13 Para 15 Para 17+3	Same topic: Risk Management, Risk Assessment (editorial pick)
2.2	Compliance monitoring	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
2.3	Independent review of information and network security	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
3. Incident handling · 5
3.1	Incident handling policy	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
3.2	Monitoring and logging	Editorial	Para 23	Same topic: Intrusion Detection (editorial pick)
3.3	Event reporting	Editorial	Para 35 Para 36	Same topic: Reporting (editorial pick)
3.5	Incident response	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
3.6	Post-incident reviews	Editorial	Para 25	Same topic: Lessons Learned (editorial pick)
4. Business continuity and crisis management · 1
4.3	Crisis management	Editorial	Para 25	Same topic: Communication (editorial pick)
5. Supply chain security · 2
5.1	Supply chain security policy	Editorial	Para 16 Para 22 Para 28+1	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
5.2	Directory of suppliers and service providers	Editorial	Para 16 Para 22 Para 28+1	Same topic: Vendor Risk Mgmt (editorial pick)
6. Security in acquisition, development and maintenance · 3
6.1	Security in acquisition of ICT services, ICT systems or ICT products	Editorial	Para 16 Para 22 Para 28+1	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
6.5	Security testing	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
6.10	Vulnerability handling and disclosure	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
12. Asset management · 4
12.1	Asset classification	Editorial	Para 20	Same topic: Data Classification (editorial pick)
12.2	Handling of assets	Editorial	Para 21	Same topic: Data Protection (editorial pick)
12.3	Removable media policy	Editorial	Para 21	Same topic: Data Protection (editorial pick)
12.4	Asset inventory	Editorial	Para 20	Same topic: Asset Management (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

NIS2 vs CPS 234

Have NIS2 → need CPS 234

Have CPS 234 → need NIS2

By topic