NIS2 · 1. Policy on the security of network and information systems
1.1
Policy on the security of network and information systems
frameworkNIS2 Implementing Regulation (EU) 2024/2690
section1. Policy on the security of network and information systems
csf 2.0GV.OC-02 GV.OC-03 GV.PO-01 GV.PO-02 GV.RM-03 PR.AT-02
topicsGovernance Policy
frameworks5 4 2
Official text · not licensableTitle from ENISA's guidance: Policy on the security of network and information systems. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.PO-01GV.PO-02 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Crosswalk | Same topic: Governance Policy4 loosely related (not mappings)GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered Only shares CSF GV.OC-02: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Only shares CSF GV.OC-03: related, not a mapping GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes Only shares CSF GV.RM-03: related, not a mapping PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Only shares CSF PR.AT-02: related, not a mapping |
| ISO 27001 | A.5.1A.5.37Clause 5.2A.5.4A.5.36Clause 9.3 | Policies for information security; Documented operating procedures… | Crosswalk | Same topic: Governance Policy ENISA NIS2 → ISO 27001 mapping 21 loosely related (not mappings)A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping A.5.2 Information security roles and responsibilities Only shares CSF PR.AT-02: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03: related, not a mapping …and 13 more in the downloads |
| CIS v8.1 | CIS 14.9CIS 14.2CIS 14.3CIS 14.4 | Conduct Role-Specific Security Awareness and Skills Training; Train Workforce Members to Recognize Social Engineering Attacks… | No mapping. Only shares CSF PR.AT-02: related, not a mapping+4 more loosely related (not mappings)CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure Only shares CSF PR.AT-02: related, not a mapping CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents Only shares CSF PR.AT-02: related, not a mapping CIS 14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates Only shares CSF PR.AT-02: related, not a mapping CIS 14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks Only shares CSF PR.AT-02: related, not a mapping | |
| SOC 2 | CC1.1CC5.3 | Commitment to integrity and ethical values; Control activities deployed through policies and procedures | Editorial | Same topic: Governance Policy (editorial pick)7 loosely related (not mappings)CC1.4 Commitment to attracting, developing and retaining competent people Only shares CSF PR.AT-02: related, not a mapping CC2.2 Internal communication of objectives and responsibilities Only shares CSF PR.AT-02: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Only shares CSF GV.RM-03: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Only shares CSF GV.OC-03: related, not a mapping |
| PCI DSS | 12.1.112.1.2 | Information security policy established and published; Security policy reviewed at least annually | Crosswalk | Same topic: Governance Policy40 loosely related (not mappings)12.1.4 Executive responsibility for information security assigned Only shares CSF GV.OC-02, GV.PO-01: related, not a mapping 12.8.1 List of third-party service providers kept Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.OC-02, GV.OC-03: related, not a mapping 12.10.4.1 Training frequency set by targeted risk analysis Only shares CSF GV.RM-03, PR.AT-02: related, not a mapping 1.1.1 Network security policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 2.1.1 Secure configuration policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping …and 32 more in the downloads |
| CMMC | AT.L2-3.2.2RA.L2-3.11.1CA.L2-3.12.1 | Role-Based Training; Risk Assessments… | No mapping. Only shares CSF PR.AT-02, GV.OC-02, GV.OC-03: related, not a mapping | |
| 800-53 | PL-1PM-1 | Policy and Procedures; Information Security Program Plan | Crosswalk | Same topic: Governance Policy32 loosely related (not mappings)…and 24 more in the downloads |
| HIPAA | §164.316(a)§164.316(b)(2)(iii) | Policies and Procedures; Updates | Crosswalk | Same topic: Governance Policy26 loosely related (not mappings)§164.308(a)(5) Security Awareness and Training Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02, PR.AT-02: related, not a mapping §164.308(a)(1) Security Management Process Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3) Workforce Security Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF GV.OC-03, GV.PO-01, GV.PO-02: related, not a mapping …and 18 more in the downloads |
| GDPR | Art.24(2) | Responsibility of the controller | Editorial | Same topic: Governance Policy (editorial pick)4 loosely related (not mappings)Art.5(2) Principles relating to processing of personal data Only shares CSF GV.OC-03: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Governance Policy (editorial pick)10 loosely related (not mappings)…and 2 more in the downloads |
| CPS 234 | Para 18Para 19 | Maintain an information security policy framework; Policies direct everyone with security obligations | Editorial | Same topic: Governance Policy (editorial pick)7 loosely related (not mappings)Para 13 Board ultimately responsible for information security Only shares CSF GV.RM-03: related, not a mapping Para 15 Maintain a capability commensurate with threats Only shares CSF GV.RM-03: related, not a mapping Para 27 Systematic testing programme for control effectiveness Only shares CSF GV.RM-03: related, not a mapping Para 31 Review the testing programme at least annually Only shares CSF GV.RM-03: related, not a mapping Para 32 Internal audit reviews control design and effectiveness Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Only shares CSF GV.OC-03: related, not a mapping Para 34 Internal audit assesses third-party assurance relied on Only shares CSF GV.OC-03: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.