Comparison
NIS2 vs NIST CSF 2.0: an EU legal requirement through a NIST lens
NIST Cybersecurity Framework 2.0 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
For organisations that run their security programme on NIST CSF 2.0, often US-headquartered companies with EU operations, the question is how far CSF gets them toward NIS2. ENISA's technical implementation guidance maps each requirement of Implementing Regulation (EU) 2024/2690 to CSF 2.0 subcategories as well as to ISO 27001.
The answer is: most of the way on technical measures. Nearly every NIS2 point is covered by CSF outcomes, with a few only loosely related. The one unmatched point concerns returning or deleting assets when employment ends, which ENISA maps to ISO but not to CSF.
Going from NIS2 to CSF, the unmatched CSF outcomes are mostly strategic governance items NIS2 doesn't spell out: organisational mission and strategy review, risk-appetite direction, communication lines for risk, and identity proofing.
As with ISO, mapping isn't compliance. NIS2's legal obligations (management-body accountability and training, Article 23 incident reporting deadlines, registration, national transposition) sit outside any control framework.
Key takeaways
- A CSF Target Profile that includes the NIS2-mapped subcategories is a good NIS2 implementation plan.
- Add EU-specific obligations explicitly: CSIRT reporting timelines, management training, national registration.
- If you also need certification, ISO 27001 is the route; CSF isn't certifiable.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 45 map to something in NIST CSF 2.0, 3 are only loosely related, and 1 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to NIST CSF 2.0 (1)
| NIS2 | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to NIST CSF 2.0 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (3)
| NIS2 | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | ID.RA-07 | Only shares CSF ID.RA-07: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | GV.RR-04PR.AT-02 | Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | GV.RR-04 | Only shares CSF GV.RR-04: related, not a mapping | |
Mapped (45)
| NIS2 | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Crosswalk | GV.PO-01GV.PO-02 | Same topic: Governance Policy |
| 1.2 | Roles, responsibilities and authorities | Crosswalk | GV.RR-01GV.RR-02GV.RR-03 | Same topic: Roles & Responsibilities |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Crosswalk | GV.RM-01GV.RM-02GV.RM-03+5 | Same topic: Risk Management |
| 2.2 | Compliance monitoring | Crosswalk | GV.OC-03GV.OV-03 | Same topic: Compliance |
| 2.3 | Independent review of information and network security | Editorial | GV.OC-03GV.OV-03 | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | ID.IM-04RS.MA-01RS.MA-02+2 | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | DE.AE-02DE.AE-03DE.AE-06+5 | Same topic: Intrusion Detection, Logging & Audit, SIEM / SOC |
| 3.3 | Event reporting | Crosswalk | RS.CO-02 | Same topic: Reporting |
| 3.4 | Event assessment and classification | Crosswalk | DE.AE-02DE.AE-03DE.AE-04+3 | Same topic: Anomaly Detection, SIEM / SOC |
| 3.5 | Incident response | Crosswalk | ID.IM-04RS.AN-03RS.AN-06+7 | Same topic: Incident Response, Forensics |
| 3.6 | Post-incident reviews | Crosswalk | ID.IM-03RC.RP-06 | Same topic: Lessons Learned |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Crosswalk | GV.OC-04ID.IM-04PR.IR-03+4 | Same topic: Business Continuity, Recovery Planning, Disaster Recovery |
| 4.2 | Backup management | Crosswalk | PR.DS-11PR.IR-03RC.RP-02+2 | Same topic: Backup & Recovery, Disaster Recovery |
| 4.3 | Crisis management | Crosswalk | GV.OC-04PR.IR-03RC.CO-03+4 | Same topic: Business Continuity, Comms & Restore |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | DE.CM-06GV.SC-01GV.SC-03+7 | Same topic: Vendor Risk Mgmt, Supply Chain Risk |
| 5.2 | Directory of suppliers and service providers | Crosswalk | DE.CM-06GV.SC-04GV.SC-06+2 | Same topic: Vendor Risk Mgmt |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | DE.CM-06GV.SC-01GV.SC-03+10 | Same topic: Vendor Risk Mgmt, Supply Chain Risk |
| 6.2 | Secure development life cycle | Crosswalk | PR.PS-06 | Same topic: Secure Development |
| 6.3 | Configuration management | Crosswalk | PR.PS-01 | Same topic: Secure Config |
| 6.5 | Security testing | Crosswalk | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt |
| 6.6 | Security patch management | Crosswalk | PR.PS-02 | Same topic: Patch Management |
| 6.7 | Network security | Crosswalk | ID.AM-03PR.IR-01 | Same topic: Firewall / Net Seg |
| 6.8 | Network segmentation | Crosswalk | ID.AM-03PR.AA-03PR.AA-04+2 | Same topic: Firewall / Net Seg, Zero Trust |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | DE.CM-09PR.DS-02PR.PS-05 | Same topic: Endpoint Protection, Email Security |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Crosswalk | GV.RM-01GV.RM-02GV.RM-03+1 | Same topic: Risk Management |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | PR.AT-01PR.AT-02 | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | PR.AT-01PR.AT-02 | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | PR.DS-01PR.DS-02 | Same topic: Encryption |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Crosswalk | DE.CM-03GV.RR-04 | Same topic: Insider Threat |
| 10.4 | Disciplinary process | Crosswalk | DE.CM-03GV.RR-04 | Same topic: Insider Threat |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | PR.AA-01PR.AA-03PR.AA-04+2 | Same topic: Access Control, Zero Trust |
| 11.2 | Management of access rights | Crosswalk | PR.AA-01PR.AA-05 | Same topic: Access Control |
| 11.3 | Privileged accounts and system administration accounts | Crosswalk | PR.AA-05 | Same topic: Privileged Access |
| 11.4 | Administration systems | Crosswalk | PR.AA-05 | Same topic: Privileged Access |
| 11.5 | Identification | Crosswalk | PR.AA-01PR.AA-05 | Same topic: Access Control |
| 11.6 | Authentication | Crosswalk | PR.AA-03PR.AA-04PR.AA-05+1 | Same topic: Multi-Factor Auth, Zero Trust |
| 11.7 | Multi-factor authentication | Crosswalk | PR.AA-03 | Same topic: Multi-Factor Auth |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Crosswalk | ID.AM-05ID.AM-07 | Same topic: Data Classification |
| 12.2 | Handling of assets | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | PR.DS-01PR.DS-02PR.DS-10 | Same topic: Data Protection, DLP |
| 12.4 | Asset inventory | Crosswalk | ID.AM-01ID.AM-02ID.AM-04+1 | Same topic: Asset Management |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Same topic: Physical Security |
| 13.2 | Protection against physical and environmental threats | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Same topic: Physical Security |
| 13.3 | Perimeter and physical access control | Crosswalk | DE.CM-02PR.AA-06PR.IR-02 | Same topic: Physical Security |
Of 106 NIST Cybersecurity Framework 2.0 requirements, 85 map to something in NIS2, 12 are only loosely related, and 9 have no mapping in our data.
Likely new work: NIST CSF 2.0 requirements with no mapping to NIS2 (9)
| NIST CSF 2.0 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Govern (GV) · 5 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | No mapping in our data | — | No mapping to NIS2 in our data. |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | No mapping in our data | — | No mapping to NIS2 in our data. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | No mapping in our data | — | No mapping to NIS2 in our data. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | No mapping in our data | — | No mapping to NIS2 in our data. |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | No mapping in our data | — | No mapping to NIS2 in our data. |
| Identify (ID) · 2 | ||||
| ID.IM-01 | Improvements are identified from evaluations | No mapping in our data | — | No mapping to NIS2 in our data. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | No mapping in our data | — | No mapping to NIS2 in our data. |
| Protect (PR) · 2 | ||||
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | No mapping in our data | — | No mapping to NIS2 in our data. |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (12)
| NIST CSF 2.0 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Detect (DE) · 1 | ||||
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | 4.3 | Only shares CSF DE.AE-07: related, not a mapping | |
| Govern (GV) · 6 | ||||
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | 1.1 | Only shares CSF GV.OC-02: related, not a mapping | |
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | 5.15.213.1 | Only shares CSF GV.OC-05: related, not a mapping | |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | 2.22.3 | Only shares CSF GV.OV-02: related, not a mapping | |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | 1.2 | Only shares CSF GV.SC-02: related, not a mapping | |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | 3.14.1 | Only shares CSF GV.SC-08: related, not a mapping | |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | 5.1 | Only shares CSF GV.SC-10: related, not a mapping | |
| Identify (ID) · 2 | ||||
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | 2.16.10 | Only shares CSF ID.RA-02: related, not a mapping | |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | 6.4 | Only shares CSF ID.RA-07: related, not a mapping | |
| Protect (PR) · 1 | ||||
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | 6.10 | Only shares CSF PR.PS-03: related, not a mapping | |
| Respond (RS) · 2 | ||||
| RS.AN-08 | An incident's magnitude is estimated and validated | 3.6 | Only shares CSF RS.AN-08: related, not a mapping | |
| RS.MA-05 | The criteria for initiating incident recovery are applied | 3.1 | Only shares CSF RS.MA-05: related, not a mapping | |
Mapped (85)
| NIST CSF 2.0 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Detect (DE) · 10 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Crosswalk | 3.23.4 | Same topic: Intrusion Detection, Anomaly Detection |
| DE.AE-03 | Information is correlated from multiple sources | Crosswalk | 3.23.4 | Same topic: Logging & Audit, SIEM / SOC |
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Crosswalk | 3.4 | Same topic: Anomaly Detection |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Crosswalk | 3.23.4 | Same topic: SIEM / SOC |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Crosswalk | 3.23.4 | Same topic: SIEM / SOC |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Crosswalk | 3.2 | Same topic: Cont. Monitoring, Intrusion Detection |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Crosswalk | 3.210.210.4 | Same topic: Cont. Monitoring, Insider Threat |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Crosswalk | 3.23.46.9 | Same topic: Cont. Monitoring, Anomaly Detection, Endpoint Protection, Email Security |
| Govern (GV) · 20 | ||||
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Crosswalk | 2.22.3 | Same topic: Compliance |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Crosswalk | 4.14.3 | Same topic: Business Continuity |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Crosswalk | 2.22.3 | Same topic: Compliance |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Crosswalk | 1.1 | Same topic: Governance Policy |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | 1.1 | Same topic: Governance Policy |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Crosswalk | 2.17.1 | Same topic: Risk Management |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Crosswalk | 2.17.1 | Same topic: Risk Management |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Crosswalk | 2.17.1 | Same topic: Risk Management |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Crosswalk | 2.17.1 | Same topic: Risk Management |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Crosswalk | 1.2 | Same topic: Roles & Responsibilities |
| GV.RR-04 | Cybersecurity is included in human resources practices | Crosswalk | 10.210.4 | Same topic: Insider Threat |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| Identify (ID) · 17 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Crosswalk | 12.4 | Same topic: Asset Management |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Crosswalk | 12.4 | Same topic: Asset Management |
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | Crosswalk | 6.76.8 | Same topic: Firewall / Net Seg |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Crosswalk | 6.112.4 | Same topic: Cloud Security, Asset Management |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | Crosswalk | 12.1 | Same topic: Data Classification |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | Crosswalk | 12.1 | Same topic: Data Classification |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Crosswalk | 12.4 | Same topic: Asset Management |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Crosswalk | 3.6 | Same topic: Lessons Learned |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Crosswalk | 3.13.54.1 | Same topic: Incident Response, Recovery Planning |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Crosswalk | 2.1 | Same topic: Risk Assessment |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Crosswalk | 2.1 | Same topic: Risk Assessment |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Crosswalk | 2.1 | Same topic: Risk Assessment |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Crosswalk | 2.1 | Same topic: Risk Assessment |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| Protect (PR) · 19 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| PR.AA-03 | Users, services, and hardware are authenticated | Crosswalk | 6.811.111.6+1 | Same topic: Zero Trust, Multi-Factor Auth |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | Crosswalk | 6.811.111.6 | Same topic: Zero Trust |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Crosswalk | 6.811.111.2+4 | Same topic: Zero Trust, Access Control |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Crosswalk | 9.112.212.3 | Same topic: Encryption, Data Protection, DLP |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Crosswalk | 6.99.112.2+1 | Same topic: Email Security, Encryption, Data Protection |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Crosswalk | 12.212.3 | Same topic: Data Protection, DLP |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | Crosswalk | 6.16.76.8+2 | Same topic: Cloud Security, Firewall / Net Seg, Zero Trust |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | Crosswalk | 13.113.213.3 | Same topic: Physical Security |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Crosswalk | 4.14.24.3 | Same topic: Business Continuity, Disaster Recovery |
| PR.PS-01 | Configuration management practices are established and applied | Crosswalk | 6.16.3 | Same topic: Cloud Security, Secure Config |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Crosswalk | 6.6 | Same topic: Patch Management |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Crosswalk | 3.2 | Same topic: Logging & Audit |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | Crosswalk | 6.2 | Same topic: Secure Development |
| Recover (RC) · 8 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | Crosswalk | 4.3 | Same topic: Comms & Restore |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | Crosswalk | 4.3 | Same topic: Comms & Restore |
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | Crosswalk | 4.1 | Same topic: Recovery Planning |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Crosswalk | 4.14.2 | Same topic: Recovery Planning, Disaster Recovery |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Crosswalk | 4.14.3 | Same topic: Business Continuity |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Crosswalk | 4.14.24.3 | Same topic: Disaster Recovery, Comms & Restore |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Crosswalk | 3.6 | Same topic: Lessons Learned |
| Respond (RS) · 11 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | Crosswalk | 3.5 | Same topic: Forensics |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | Crosswalk | 3.5 | Same topic: Forensics |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | Crosswalk | 3.5 | Same topic: Forensics |
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Crosswalk | 3.3 | Same topic: Reporting |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | Crosswalk | 4.3 | Same topic: Communication |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Crosswalk | 3.13.5 | Same topic: Incident Response |
| RS.MA-02 | Incident reports are triaged and validated | Crosswalk | 3.13.5 | Same topic: Incident Response |
| RS.MA-03 | Incidents are categorized and prioritized | Crosswalk | 3.13.5 | Same topic: Incident Response |
| RS.MA-04 | Incidents are escalated or elevated as needed | Crosswalk | 3.13.5 | Same topic: Incident Response |
| RS.MI-01 | Incidents are contained | Crosswalk | 3.5 | Same topic: Mitigation |
| RS.MI-02 | Incidents are eradicated | Crosswalk | 3.5 | Same topic: Mitigation |
By topic
Both cover (43):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityZero TrustCloud SecurityDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only NIST CSF 2.0 (7):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.