NIS2 · 1. Policy on the security of network and information systems

Roles, responsibilities and authorities

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section1. Policy on the security of network and information systems csf 2.0GV.RR-02 GV.SC-02 PR.AT-02 topicsRoles & Responsibilities frameworks5 4 2

Official text · not licensableTitle from ENISA's guidance: Roles, responsibilities and authorities. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 1.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-01 GV.RR-02 GV.RR-03	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced…	Crosswalk	Same topic: Roles & Responsibilities 2 loosely related (not mappings) GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally Loosely related Only shares CSF GV.SC-02: related, not a mapping PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind Loosely related Only shares CSF PR.AT-02: related, not a mapping
ISO 27001	A.5.2 A.5.4 A.5.3 Clause 5.3	Information security roles and responsibilities; Management responsibilities…	Crosswalk	Same topic: Roles & Responsibilities ENISA NIS2 → ISO 27001 mapping 3 loosely related (not mappings) A.6.3 Information security awareness, education and training Loosely related Only shares CSF PR.AT-02: related, not a mapping Clause 7.2 Competence Loosely related Only shares CSF GV.RR-02: related, not a mapping Clause 7.3 Awareness Loosely related Only shares CSF PR.AT-02: related, not a mapping
CIS v8.1	CIS 14.9 CIS 15.4 CIS 14.2 CIS 14.3	Conduct Role-Specific Security Awareness and Skills Training; Ensure Service Provider Contracts Include Security Requirements…	Loosely related	No mapping. Only shares CSF GV.RR-02, PR.AT-02, GV.SC-02: related, not a mapping +5 more loosely related (not mappings) CIS 14.4 Train Workforce on Data Handling Best Practices Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates Loosely related Only shares CSF PR.AT-02: related, not a mapping …and 1 more in the downloads
SOC 2	CC1.2 CC1.3 CC1.5	Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities…	Editorial	Same topic: Roles & Responsibilities (editorial pick) 2 loosely related (not mappings) CC1.4 Commitment to attracting, developing and retaining competent people Loosely related Only shares CSF PR.AT-02: related, not a mapping CC2.2 Internal communication of objectives and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping
PCI DSS	12.1.3 12.1.4	Security roles and responsibilities defined; Executive responsibility for information security assigned	Crosswalk	Same topic: Roles & Responsibilities 17 loosely related (not mappings) 1.1.2 Roles for network security controls assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 2.1.2 Roles for secure configuration assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 3.1.2 Roles for protecting stored account data assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 5.1.2 Roles for malware protection assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF PR.AT-02: related, not a mapping 7.1.2 Roles for access restriction assigned Loosely related Only shares CSF GV.RR-02: related, not a mapping …and 9 more in the downloads
CMMC	AT.L2-3.2.2	Role-Based Training	Loosely related	No mapping. Only shares CSF PR.AT-02: related, not a mapping
800-53	PM-2 PM-29 PS-9	Information Security Program Leadership Role; Risk Management Program Leadership Roles…	Crosswalk	Same topic: Roles & Responsibilities 8 loosely related (not mappings) AT-3 Role-based Training Loosely related Only shares CSF PR.AT-02: related, not a mapping PM-13 Security and Privacy Workforce Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-19 Privacy Program Leadership Role Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF GV.RR-02: related, not a mapping PM-24 Data Integrity Board Loosely related Only shares CSF GV.RR-02: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-02: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-02: related, not a mapping
HIPAA	§164.308(a)(2)	Assigned Security Responsibility	Crosswalk	Same topic: Roles & Responsibilities 5 loosely related (not mappings) §164.308(a)(5) Security Awareness and Training Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(A) Security Reminders Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-02: related, not a mapping
GDPR	Art.37(1)Art.39(1)	Designation of the data protection officer; Tasks of the data protection officer	Editorial	Same topic: Roles & Responsibilities (editorial pick) 1 loosely related (not mappings) Art.39(1)(b) Tasks of the data protection officer Loosely related Only shares CSF PR.AT-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(c)Art.5(3)Art.6(4)	Governance and organisation; Governance and organisation…	Editorial	Same topic: Roles & Responsibilities (editorial pick) 2 loosely related (not mappings) Art.5(4) Governance and organisation Loosely related Only shares CSF PR.AT-02: related, not a mapping Art.13(6) Learning and evolving Loosely related Only shares CSF PR.AT-02: related, not a mapping
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Editorial	Same topic: Roles & Responsibilities (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.