Comparison

NIS2 vs Cyber Essentials

NIS2 Implementing Regulation (EU) 2024/2690 · UK Cyber Essentials (NCSC) · data 2026-10-27

Requirement-level comparison of NIS2 Implementing Regulation (EU) 2024/2690 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have NIS2 → need Cyber Essentials

5 reqs

5 mapped · · 0 no mapping Open in gap view →

Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in NIS2, 0 are only loosely related, and 0 have no mapping in our data.

Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.

Mapped (5)

Cyber Essentials	Requirement	Match	NIS2	Evidence
Technical controls · 5
CE 1	Firewalls	Editorial	6.7 6.8	Same topic: Firewall / Net Seg (editorial pick)
CE 2	Secure Configuration	Editorial	6.3	Same topic: Secure Config (editorial pick)
CE 3	Security Update Management	Editorial	6.5 6.6 6.10+1	Same topic: Vulnerability Mgmt, Patch Management (editorial pick)
CE 4	User Access Control	Editorial	6.1 11.1 11.2+5	Same topic: Cloud Security, Access Control (editorial pick)
CE 5	Malware protection	Editorial	6.9	Same topic: Endpoint Protection (editorial pick)

Have Cyber Essentials → need NIS2

49 reqs

16 mapped · · 30 no mapping Open in gap view →

Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 16 map to something in Cyber Essentials, 3 are only loosely related, and 30 have no mapping in our data.

NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.

Likely new work: NIS2 requirements with no mapping to Cyber Essentials (30)

NIS2	Requirement	Match	Cyber Essentials	Evidence
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	No mapping in our data	—	No mapping to Cyber Essentials in our data.
1.2	Roles, responsibilities and authorities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2. Risk management policy · 2
2.2	Compliance monitoring	No mapping in our data	—	No mapping to Cyber Essentials in our data.
2.3	Independent review of information and network security	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3. Incident handling · 6
3.1	Incident handling policy	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.2	Monitoring and logging	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.3	Event reporting	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.4	Event assessment and classification	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.5	Incident response	No mapping in our data	—	No mapping to Cyber Essentials in our data.
3.6	Post-incident reviews	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4. Business continuity and crisis management · 2
4.1	Business continuity and disaster recovery plan	No mapping in our data	—	No mapping to Cyber Essentials in our data.
4.2	Backup management	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5. Supply chain security · 2
5.1	Supply chain security policy	No mapping in our data	—	No mapping to Cyber Essentials in our data.
5.2	Directory of suppliers and service providers	No mapping in our data	—	No mapping to Cyber Essentials in our data.
6. Security in acquisition, development and maintenance · 1
6.4	Change management, repairs and maintenance	No mapping in our data	—	No mapping to Cyber Essentials in our data.
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	No mapping in our data	—	No mapping to Cyber Essentials in our data.
8.2	Security training	No mapping in our data	—	No mapping to Cyber Essentials in our data.
9. Cryptography · 1
9.1	Cryptography	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10. Human resources security · 4
10.1	Human resources security	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.2	Verification of Background	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.3	Termination or change of employment procedures	No mapping in our data	—	No mapping to Cyber Essentials in our data.
10.4	Disciplinary process	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12. Asset management · 4
12.1	Asset classification	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.2	Handling of assets	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.3	Removable media policy	No mapping in our data	—	No mapping to Cyber Essentials in our data.
12.5	Deposit, return or deletion of assets upon termination of employment	No mapping in our data	—	No mapping to Cyber Essentials in our data.
13. Environmental and physical security · 3
13.1	Supporting utilities	No mapping in our data	—	No mapping to Cyber Essentials in our data.
13.2	Protection against physical and environmental threats	No mapping in our data	—	No mapping to Cyber Essentials in our data.
13.3	Perimeter and physical access control	No mapping in our data	—	No mapping to Cyber Essentials in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (3)

NIS2	Requirement	Match	Cyber Essentials	Evidence
2. Risk management policy · 1
2.1	Risk management framework	Loosely related	CE 3	Only shares CSF ID.RA-01: related, not a mapping
4. Business continuity and crisis management · 1
4.3	Crisis management	Loosely related	CE 1	Only shares CSF ID.AM-03: related, not a mapping
6. Security in acquisition, development and maintenance · 1
6.2	Secure development life cycle	Loosely related	CE 3	Only shares CSF ID.AM-08: related, not a mapping

Mapped (16)

NIS2	Requirement	Match	Cyber Essentials	Evidence
6. Security in acquisition, development and maintenance · 8
6.1	Security in acquisition of ICT services, ICT systems or ICT products	Editorial	CE 4	Same topic: Cloud Security (editorial pick)
6.3	Configuration management	Editorial	CE 2	Same topic: Secure Config (editorial pick)
6.5	Security testing	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
6.6	Security patch management	Editorial	CE 3	Same topic: Patch Management (editorial pick)
6.7	Network security	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
6.8	Network segmentation	Editorial	CE 1	Same topic: Firewall / Net Seg (editorial pick)
6.9	Protection against malicious and unauthorised software	Editorial	CE 5	Same topic: Endpoint Protection (editorial pick)
6.10	Vulnerability handling and disclosure	Editorial	CE 3	Same topic: Vulnerability Mgmt (editorial pick)
11. Access control · 7
11.1	Access control policy	Editorial	CE 4	Same topic: Access Control (editorial pick)
11.2	Management of access rights	Editorial	CE 4	Same topic: Access Control (editorial pick)
11.3	Privileged accounts and system administration accounts	Editorial	CE 4	Same topic: Privileged Access (editorial pick)
11.4	Administration systems	Editorial	CE 4	Same topic: Privileged Access (editorial pick)
11.5	Identification	Editorial	CE 4	Same topic: Access Control (editorial pick)
11.6	Authentication	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
11.7	Multi-factor authentication	Editorial	CE 4	Same topic: Multi-Factor Auth (editorial pick)
12. Asset management · 1
12.4	Asset inventory	Editorial	CE 3	Same topic: Asset Management (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

NIS2 vs Cyber Essentials

Have NIS2 → need Cyber Essentials

Have Cyber Essentials → need NIS2

By topic