NIS2 Implementing Regulation (EU) 2024/2690
What it is
The EU's cybersecurity directive (2022/2555): risk-management measures (Article 21), incident reporting (Article 23) and management accountability (Article 20) for essential and important entities in 18 sectors. ControlMapping's requirements are the Annex of Implementing Regulation (EU) 2024/2690, which details the measures for DNS, cloud, data centre, managed service and other digital providers.
Who needs it
Medium and large entities in the sectors listed in the directive's Annexes I and II, plus some entities of any size. National law decides the details. See the NIS2 guide.
How it's assessed
National competent authorities supervise: proactively for essential entities, after the fact for important entities. There is no general NIS2 certificate, although member states may require certification schemes for some services.
Read the guide: NIS2 compliance: a practical guide →
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Comparisons
Requirements
| ID | Requirement | Topics | Mapped in |
|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | |||
| 1.1 | Policy on the security of network and information systems | Governance Policy | 9 of 13 |
| 1.2 | Roles, responsibilities and authorities | Roles & Responsibilities | 9 of 13 |
| 2. Risk management policy · 3 | |||
| 2.1 | Risk management framework | Risk Management, Risk Assessment | 10 of 13 |
| 2.2 | Compliance monitoring | Compliance | 10 of 13 |
| 2.3 | Independent review of information and network security | Compliance | 10 of 13 |
| 3. Incident handling · 6 | |||
| 3.1 | Incident handling policy | Incident Response | 12 of 13 |
| 3.2 | Monitoring and logging | Cont. Monitoring, Logging & Audit, Intrusion Detection, SIEM / SOC | 11 of 13 |
| 3.3 | Event reporting | Reporting | 12 of 13 |
| 3.4 | Event assessment and classification | Anomaly Detection, SIEM / SOC | 10 of 13 |
| 3.5 | Incident response | Incident Response, Forensics, Mitigation | 12 of 13 |
| 3.6 | Post-incident reviews | Lessons Learned | 9 of 13 |
| 4. Business continuity and crisis management · 3 | |||
| 4.1 | Business continuity and disaster recovery plan | Recovery Planning, Business Continuity, Disaster Recovery | 10 of 13 |
| 4.2 | Backup management | Backup & Recovery, Disaster Recovery | 11 of 13 |
| 4.3 | Crisis management | Communication, Business Continuity, Comms & Restore | 11 of 13 |
| 5. Supply chain security · 2 | |||
| 5.1 | Supply chain security policy | Supply Chain Risk, Vendor Risk Mgmt | 10 of 13 |
| 5.2 | Directory of suppliers and service providers | Vendor Risk Mgmt | 10 of 13 |
| 6. Security in acquisition, development and maintenance · 10 | |||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Supply Chain Risk, Cloud Security, Vendor Risk Mgmt | 12 of 13 |
| 6.2 | Secure development life cycle | Secure Development | 8 of 13 |
| 6.3 | Configuration management | Secure Config | 9 of 13 |
| 6.4 | Change management, repairs and maintenance | — | 3 of 13 |
| 6.5 | Security testing | Vulnerability Mgmt | 13 of 13 |
| 6.6 | Security patch management | Patch Management | 10 of 13 |
| 6.7 | Network security | Firewall / Net Seg | 9 of 13 |
| 6.8 | Network segmentation | Firewall / Net Seg, Zero Trust | 9 of 13 |
| 6.9 | Protection against malicious and unauthorised software | Endpoint Protection, Email Security | 10 of 13 |
| 6.10 | Vulnerability handling and disclosure | Vulnerability Mgmt | 13 of 13 |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | |||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Risk Management | 10 of 13 |
| 8. Basic cyber hygiene practices and security training · 2 | |||
| 8.1 | Awareness raising and basic cyber hygiene practices | Awareness & Training | 10 of 13 |
| 8.2 | Security training | Awareness & Training | 10 of 13 |
| 9. Cryptography · 1 | |||
| 9.1 | Cryptography | Encryption | 10 of 13 |
| 10. Human resources security · 4 | |||
| 10.1 | Human resources security | — | 1 of 13 |
| 10.2 | Verification of Background | Insider Threat | 9 of 13 |
| 10.3 | Termination or change of employment procedures | — | 2 of 13 |
| 10.4 | Disciplinary process | Insider Threat | 9 of 13 |
| 11. Access control · 7 | |||
| 11.1 | Access control policy | Access Control, Zero Trust | 11 of 13 |
| 11.2 | Management of access rights | Access Control | 11 of 13 |
| 11.3 | Privileged accounts and system administration accounts | Privileged Access | 10 of 13 |
| 11.4 | Administration systems | Privileged Access | 10 of 13 |
| 11.5 | Identification | Access Control | 11 of 13 |
| 11.6 | Authentication | Multi-Factor Auth, Zero Trust | 10 of 13 |
| 11.7 | Multi-factor authentication | Multi-Factor Auth | 10 of 13 |
| 12. Asset management · 5 | |||
| 12.1 | Asset classification | Data Classification | 9 of 13 |
| 12.2 | Handling of assets | Data Protection | 11 of 13 |
| 12.3 | Removable media policy | Data Protection, DLP | 11 of 13 |
| 12.4 | Asset inventory | Asset Management | 13 of 13 |
| 12.5 | Deposit, return or deletion of assets upon termination of employment | — | 2 of 13 |
| 13. Environmental and physical security · 3 | |||
| 13.1 | Supporting utilities | Physical Security | 8 of 13 |
| 13.2 | Protection against physical and environmental threats | Physical Security | 8 of 13 |
| 13.3 | Perimeter and physical access control | Physical Security | 8 of 13 |
Topic coverage
Topics with mapped NIS2 requirements (43):
No mapping in our data No NIS2 requirement (7):