Comparison

SOC 2 vs NIS2: a customer report and an EU law

SOC 2 (Trust Services Criteria) · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27

By Paul Gillet · Updated 2026-10-17

SOC 2 and NIS2 rarely get compared directly, but US-origin software companies expanding into the EU increasingly face both. SOC 2 is a voluntary attestation report customers ask for; NIS2 is EU law for essential and important entities, and for digital providers its measures are spelled out in Implementing Regulation (EU) 2024/2690.

Going from SOC 2 to NIS2, nearly every requirement point maps to a SOC 2 criterion in our data: governance, risk assessment, access control, change management, incident response, vendor management and business continuity all line up. What SOC 2 doesn't give you is NIS2's legal machinery: the 24-hour, 72-hour and one-month incident reports, management training and liability, and registration with the national authority.

Going from NIS2 to SOC 2, the gaps are SOC 2's optional categories, Privacy and Processing Integrity, which NIS2 doesn't cover. Every SOC 2 link here is ControlMapping editorial, since no openly licensed SOC 2 crosswalk exists.

Key takeaways

A SOC 2 control set is a good base for NIS2 measures; the legal obligations are the new work.
Add a significant-incident reporting procedure with 24-hour and 72-hour deadlines.
Check which national law applies to you and whether you must register.

Download this comparison (CSV) Open in gap analysis →

Have SOC 2 → need NIS2

49 reqs

47 mapped · · 1 no mapping Open in gap view →

Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 47 map to something in SOC 2, 1 are only loosely related, and 1 have no mapping in our data.

NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.

Likely new work: NIS2 requirements with no mapping to SOC 2 (1)

NIS2	Requirement	Match	SOC 2	Evidence
12. Asset management · 1
12.5	Deposit, return or deletion of assets upon termination of employment	No mapping in our data	—	No mapping to SOC 2 in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (1)

NIS2	Requirement	Match	SOC 2	Evidence
10. Human resources security · 1
10.1	Human resources security	Loosely related	CC1.4 CC2.2	Only shares CSF PR.AT-02: related, not a mapping

Mapped (47)

NIS2	Requirement	Match	SOC 2	Evidence
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	Editorial	CC1.1 CC5.3	Same topic: Governance Policy (editorial pick)
1.2	Roles, responsibilities and authorities	Editorial	CC1.2 CC1.3 CC1.5	Same topic: Roles & Responsibilities (editorial pick)
2. Risk management policy · 3
2.1	Risk management framework	Editorial	CC3.1 CC3.2 CC3.3+3	Same topic: Risk Management, Risk Assessment (editorial pick)
2.2	Compliance monitoring	Editorial	CC4.1 CC4.2	Same topic: Compliance (editorial pick)
2.3	Independent review of information and network security	Editorial	CC4.1 CC4.2	Same topic: Compliance (editorial pick)
3. Incident handling · 6
3.1	Incident handling policy	Editorial	CC7.3 CC7.4	Same topic: Incident Response (editorial pick)
3.2	Monitoring and logging	Editorial	CC7.2 CC7.3	Same topic: Cont. Monitoring, Logging & Audit, Intrusion Detection, SIEM / SOC (editorial pick)
3.3	Event reporting	Editorial	CC2.3	Same topic: Reporting (editorial pick)
3.4	Event assessment and classification	Editorial	CC7.2 CC7.3	Same topic: Anomaly Detection, SIEM / SOC (editorial pick)
3.5	Incident response	Editorial	CC7.3 CC7.4	Same topic: Incident Response, Forensics, Mitigation (editorial pick)
3.6	Post-incident reviews	Editorial	CC7.5	Same topic: Lessons Learned (editorial pick)
4. Business continuity and crisis management · 3
4.1	Business continuity and disaster recovery plan	Editorial	A1.1 A1.2 A1.3+2	Same topic: Business Continuity, Disaster Recovery, Recovery Planning (editorial pick)
4.2	Backup management	Editorial	A1.2 A1.3	Same topic: Backup & Recovery, Disaster Recovery (editorial pick)
4.3	Crisis management	Editorial	A1.1 A1.2 CC2.3+2	Same topic: Business Continuity, Communication, Comms & Restore (editorial pick)
5. Supply chain security · 2
5.1	Supply chain security policy	Editorial	CC9.2	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
5.2	Directory of suppliers and service providers	Editorial	CC9.2	Same topic: Vendor Risk Mgmt (editorial pick)
6. Security in acquisition, development and maintenance · 10
6.1	Security in acquisition of ICT services, ICT systems or ICT products	Editorial	CC9.2	Same topic: Supply Chain Risk, Cloud Security, Vendor Risk Mgmt (editorial pick)
6.2	Secure development life cycle	Editorial	CC8.1	Same topic: Secure Development (editorial pick)
6.3	Configuration management	Editorial	CC5.2 CC7.1	Same topic: Secure Config (editorial pick)
6.4	Change management, repairs and maintenance	Editorial	CC8.1	ControlMapping editorial: Change management: SOC 2 requires changes to be authorised, tested and approved; NIS2 point 6.4 requires change management, repairs and maintenance procedures.
6.5	Security testing	Editorial	CC7.1	Same topic: Vulnerability Mgmt (editorial pick)
6.6	Security patch management	Editorial	CC7.1	Same topic: Patch Management (editorial pick)
6.7	Network security	Editorial	CC6.6	Same topic: Firewall / Net Seg (editorial pick)
6.8	Network segmentation	Editorial	CC6.6	Same topic: Firewall / Net Seg, Zero Trust (editorial pick)
6.9	Protection against malicious and unauthorised software	Editorial	CC6.8	Same topic: Endpoint Protection, Email Security (editorial pick)
6.10	Vulnerability handling and disclosure	Editorial	CC7.1	Same topic: Vulnerability Mgmt (editorial pick)
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Editorial	CC3.1 CC5.1 CC9.1	Same topic: Risk Management (editorial pick)
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	Editorial	CC1.4 CC2.2	Same topic: Awareness & Training (editorial pick)
8.2	Security training	Editorial	CC1.4 CC2.2	Same topic: Awareness & Training (editorial pick)
9. Cryptography · 1
9.1	Cryptography	Editorial	CC6.1 CC6.7	Same topic: Encryption (editorial pick)
10. Human resources security · 3
10.2	Verification of Background	Editorial	CC1.4	ControlMapping editorial: Background verification: SOC 2's commitment to competence includes screening; NIS2 point 10.2 requires background checks where appropriate.
10.3	Termination or change of employment procedures	Editorial	CC6.2	ControlMapping editorial: Leavers and movers: SOC 2 requires access to be removed when no longer needed; NIS2 point 10.3 covers termination or change of employment.
10.4	Disciplinary process	Editorial	CC1.5	ControlMapping editorial: Accountability: SOC 2 holds people accountable for their responsibilities; NIS2 point 10.4 requires a disciplinary process for violations.
11. Access control · 7
11.1	Access control policy	Editorial	CC6.1 CC6.2 CC6.3+1	Same topic: Access Control (editorial pick)
11.2	Management of access rights	Editorial	CC6.1 CC6.2 CC6.3	Same topic: Access Control (editorial pick)
11.3	Privileged accounts and system administration accounts	Editorial	CC6.3	Same topic: Privileged Access (editorial pick)
11.4	Administration systems	Editorial	CC6.3	Same topic: Privileged Access (editorial pick)
11.5	Identification	Editorial	CC6.1 CC6.2 CC6.3	Same topic: Access Control (editorial pick)
11.6	Authentication	Editorial	CC6.1 CC6.6	Same topic: Multi-Factor Auth, Zero Trust (editorial pick)
11.7	Multi-factor authentication	Editorial	CC6.1	Same topic: Multi-Factor Auth (editorial pick)
12. Asset management · 4
12.1	Asset classification	Editorial	C1.1	Same topic: Data Classification (editorial pick)
12.2	Handling of assets	Editorial	C1.2 CC6.5	Same topic: Data Protection (editorial pick)
12.3	Removable media policy	Editorial	C1.2 CC6.5 CC6.7	Same topic: Data Protection, DLP (editorial pick)
12.4	Asset inventory	Editorial	CC6.1	Same topic: Asset Management (editorial pick)
13. Environmental and physical security · 3
13.1	Supporting utilities	Editorial	CC6.4	Same topic: Physical Security (editorial pick)
13.2	Protection against physical and environmental threats	Editorial	CC6.4	Same topic: Physical Security (editorial pick)
13.3	Perimeter and physical access control	Editorial	CC6.4	Same topic: Physical Security (editorial pick)

Have NIS2 → need SOC 2

61 reqs

37 mapped · · 24 no mapping Open in gap view →

Of 61 SOC 2 (Trust Services Criteria) requirements, 37 map to something in NIS2, 0 are only loosely related, and 24 have no mapping in our data.

AICPA's SOC 2 mappings aren't openly licensed, so every SOC 2 link here is ControlMapping editorial: criteria we haven't mapped can't match. Processing-integrity (PI) criteria and most privacy (P) criteria have no equivalent in security frameworks.

Likely new work: SOC 2 requirements with no mapping to NIS2 (24)

SOC 2	Requirement	Match	NIS2	Evidence
CC2 Communication and information · 1
CC2.1	Quality information to support internal control	No mapping in our data	—	No mapping to NIS2 in our data.
P Privacy · 18
P1.1	Privacy notice	No mapping in our data	—	No mapping to NIS2 in our data.
P2.1	Choice and consent	No mapping in our data	—	No mapping to NIS2 in our data.
P3.1	Collection limited to privacy objectives	No mapping in our data	—	No mapping to NIS2 in our data.
P3.2	Explicit consent where required	No mapping in our data	—	No mapping to NIS2 in our data.
P4.1	Use limited to privacy objectives	No mapping in our data	—	No mapping to NIS2 in our data.
P4.2	Retention of personal information	No mapping in our data	—	No mapping to NIS2 in our data.
P4.3	Disposal of personal information	No mapping in our data	—	No mapping to NIS2 in our data.
P5.1	Data subject access	No mapping in our data	—	No mapping to NIS2 in our data.
P5.2	Correction of personal information	No mapping in our data	—	No mapping to NIS2 in our data.
P6.1	Disclosure to third parties with consent	No mapping in our data	—	No mapping to NIS2 in our data.
P6.2	Record of authorized disclosures	No mapping in our data	—	No mapping to NIS2 in our data.
P6.3	Record of unauthorized disclosures	No mapping in our data	—	No mapping to NIS2 in our data.
P6.4	Privacy commitments from third parties	No mapping in our data	—	No mapping to NIS2 in our data.
P6.5	Notification by third parties of unauthorized disclosures	No mapping in our data	—	No mapping to NIS2 in our data.
P6.6	Breach notification to affected individuals	No mapping in our data	—	No mapping to NIS2 in our data.
P6.7	Accounting of disclosures to data subjects	No mapping in our data	—	No mapping to NIS2 in our data.
P7.1	Quality of personal information	No mapping in our data	—	No mapping to NIS2 in our data.
P8.1	Handling privacy inquiries, complaints and disputes	No mapping in our data	—	No mapping to NIS2 in our data.
PI1 Processing integrity · 5
PI1.1	Information about processing objectives	No mapping in our data	—	No mapping to NIS2 in our data.
PI1.2	Controls over system inputs	No mapping in our data	—	No mapping to NIS2 in our data.
PI1.3	Controls over system processing	No mapping in our data	—	No mapping to NIS2 in our data.
PI1.4	Controls over system outputs	No mapping in our data	—	No mapping to NIS2 in our data.
PI1.5	Storing inputs, items in processing and outputs	No mapping in our data	—	No mapping to NIS2 in our data.

Mapped (37)

SOC 2	Requirement	Match	NIS2	Evidence
A1 Availability · 3
A1.1	Capacity management to meet availability commitments	Editorial	4.1 4.3	Same topic: Business Continuity (editorial pick)
A1.2	Environmental protections, backups and recovery infrastructure	Editorial	4.1 4.2 4.3	Same topic: Business Continuity, Disaster Recovery, Backup & Recovery (editorial pick)
A1.3	Testing recovery plan procedures	Editorial	4.1 4.2	Same topic: Recovery Planning, Disaster Recovery (editorial pick)
C1 Confidentiality · 2
C1.1	Identifying and protecting confidential information	Editorial	12.1	Same topic: Data Classification (editorial pick)
C1.2	Disposing of confidential information	Editorial	12.2 12.3	Same topic: Data Protection (editorial pick)
CC1 Control environment · 5
CC1.1	Commitment to integrity and ethical values	Editorial	1.1	Same topic: Governance Policy (editorial pick)
CC1.2	Board independence and oversight of internal control	Editorial	1.2	Same topic: Roles & Responsibilities (editorial pick)
CC1.3	Structures, reporting lines, authorities and responsibilities	Editorial	1.2	Same topic: Roles & Responsibilities (editorial pick)
CC1.4	Commitment to attracting, developing and retaining competent people	Editorial	8.1 8.2 10.2	Same topic: Awareness & Training (editorial pick)
CC1.5	Accountability for internal control responsibilities	Editorial	1.2 10.4	Same topic: Roles & Responsibilities (editorial pick)
CC2 Communication and information · 2
CC2.2	Internal communication of objectives and responsibilities	Editorial	8.1 8.2	Same topic: Awareness & Training (editorial pick)
CC2.3	Communication with external parties	Editorial	3.3 4.3	Same topic: Reporting, Communication, Comms & Restore (editorial pick)
CC3 Risk assessment · 4
CC3.1	Objectives specified clearly enough to identify risks	Editorial	2.1 7.1	Same topic: Risk Management (editorial pick)
CC3.2	Risk identification and analysis	Editorial	2.1	Same topic: Risk Assessment (editorial pick)
CC3.3	Considering the potential for fraud	Editorial	2.1	Same topic: Risk Assessment (editorial pick)
CC3.4	Identifying and assessing significant changes	Editorial	2.1	Same topic: Risk Assessment (editorial pick)
CC4 Monitoring activities · 2
CC4.1	Ongoing and/or separate evaluations of controls	Editorial	2.2 2.3	Same topic: Compliance (editorial pick)
CC4.2	Communicating and remediating control deficiencies	Editorial	2.2 2.3	Same topic: Compliance (editorial pick)
CC5 Control activities · 3
CC5.1	Control activities that mitigate risks	Editorial	2.1 7.1	Same topic: Risk Management (editorial pick)
CC5.2	General controls over technology	Editorial	6.3	Same topic: Secure Config (editorial pick)
CC5.3	Control activities deployed through policies and procedures	Editorial	1.1	Same topic: Governance Policy (editorial pick)
CC6 Logical and physical access · 8
CC6.1	Logical access security over information assets	Editorial	9.1 11.1 11.2+4	Same topic: Encryption, Access Control (editorial pick)
CC6.2	User registration, authorization and removal	Editorial	11.1 11.2 11.5+1	Same topic: Access Control (editorial pick)
CC6.3	Role-based access, least privilege and segregation of duties	Editorial	11.1 11.2 11.3+2	Same topic: Access Control, Privileged Access (editorial pick)
CC6.4	Physical access restrictions	Editorial	13.1 13.2 13.3	Same topic: Physical Security (editorial pick)
CC6.5	Protection of data when assets are disposed of	Editorial	12.2 12.3	Same topic: Data Protection (editorial pick)
CC6.6	Protection against threats from outside system boundaries	Editorial	6.7 6.8 11.1+1	Same topic: Firewall / Net Seg, Zero Trust (editorial pick)
CC6.7	Restricting transmission, movement and removal of information	Editorial	9.1 12.3	Same topic: Encryption, DLP (editorial pick)
CC6.8	Preventing or detecting unauthorized or malicious software	Editorial	6.9	Same topic: Endpoint Protection, Email Security (editorial pick)
CC7 System operations · 5
CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	6.3 6.5 6.6+1	Same topic: Secure Config, Vulnerability Mgmt, Patch Management (editorial pick)
CC7.2	Monitoring system components for anomalies	Editorial	3.2 3.4	Same topic: Cont. Monitoring, Logging & Audit, Intrusion Detection, Anomaly Detection (editorial pick)
CC7.3	Evaluating security events to determine if they are incidents	Editorial	3.1 3.2 3.4+1	Same topic: Incident Response, SIEM / SOC (editorial pick)
CC7.4	Responding to identified security incidents	Editorial	3.1 3.5	Same topic: Incident Response, Forensics, Mitigation (editorial pick)
CC7.5	Recovering from identified security incidents	Editorial	3.6 4.1 4.3	Same topic: Lessons Learned, Recovery Planning, Comms & Restore (editorial pick)
CC8 Change management · 1
CC8.1	Change management for infrastructure, data and software	Editorial	6.2 6.4	Same topic: Secure Development (editorial pick)
CC9 Risk mitigation · 2
CC9.1	Mitigating risks from business disruptions	Editorial	2.1 4.1 4.3+1	Same topic: Risk Management, Business Continuity (editorial pick)
CC9.2	Managing vendor and business partner risk	Editorial	5.1 5.2 6.1	Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security (editorial pick)

Questions

Does a SOC 2 report show NIS2 compliance?

It is useful evidence of security measures, but NIS2 compliance is judged by national authorities against the law, including reporting and governance duties SOC 2 doesn't test.

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.