NIS2 · 10. Human resources security

Human resources security

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section10. Human resources security csf 2.0GV.RR-04 PR.AT-02 topics— frameworks1 0 3

Official text · not licensableTitle from ENISA's guidance: Human resources security. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 10.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RR-04 PR.AT-02	Cybersecurity is included in human resources practices; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping
ISO 27001	A.6.2 A.6.3 Clause 7.1 Clause 7.2	Terms and conditions of employment; Information security awareness, education and training…	Crosswalk	ENISA NIS2 → ISO 27001 mapping 8 loosely related (not mappings) Clause 7.3 Awareness Loosely related Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping A.5.2 Information security roles and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping A.6.1 Screening Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.4 Disciplinary process Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.6 Confidentiality or non-disclosure agreements Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF GV.RR-04: related, not a mapping
CIS v8.1	CIS 6.1 CIS 6.2 CIS 14.9 CIS 14.2	Establish an Access Granting Process; Establish an Access Revoking Process…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping +6 more loosely related (not mappings) CIS 14.3 Train Workforce Members on Authentication Best Practices Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.4 Train Workforce on Data Handling Best Practices Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.5 Train Workforce Members on Causes of Unintentional Data Exposure Loosely related Only shares CSF PR.AT-02: related, not a mapping CIS 14.6 Train Workforce Members on Recognizing and Reporting Security Incidents Loosely related Only shares CSF PR.AT-02: related, not a mapping …and 2 more in the downloads
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Loosely related	No mapping. Only shares CSF PR.AT-02: related, not a mapping
PCI DSS	6.2.2 7.2.2 8.2.5 9.3.1.1	Developers trained in secure software development; Access assigned by job function and least privilege…	Loosely related	No mapping. Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping +4 more loosely related (not mappings) 12.6.3 Awareness training on hire and at least annually Loosely related Only shares CSF GV.RR-04: related, not a mapping 12.7.1 Personnel screened before hire Loosely related Only shares CSF GV.RR-04: related, not a mapping 12.10.4 Incident response staff trained Loosely related Only shares CSF PR.AT-02: related, not a mapping 12.10.4.1 Training frequency set by targeted risk analysis Loosely related Only shares CSF PR.AT-02: related, not a mapping
CMMC	AT.L2-3.2.2 AT.L2-3.2.3 AU.L2-3.3.2 PS.L2-3.9.1	Role-Based Training; Insider Threat Awareness…	Loosely related	No mapping. Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping
800-53	AT-3 PM-13 PS-7 PS-9	Role-based Training; Security and Privacy Workforce…	Loosely related	No mapping. Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping +2 more loosely related (not mappings) AC-2(12) Account Monitoring for Atypical Usage Loosely related Only shares CSF GV.RR-04: related, not a mapping PM-12 Insider Threat Program Loosely related Only shares CSF GV.RR-04: related, not a mapping
HIPAA	§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)§164.308(a)(3)(ii)(C)§164.308(a)(4)(ii)(B)	Authorization and/or Supervision; Workforce Clearance Procedure…	Loosely related	No mapping. Only shares CSF GV.RR-04: related, not a mapping +13 more loosely related (not mappings) §164.308(a)(5) Security Awareness and Training Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(A) Security Reminders Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-02: related, not a mapping …and 9 more in the downloads
GDPR	Art.29 Art.32(4)Art.39(1)(b)	Processing under the authority of the controller or processor; Security of processing…	Loosely related	No mapping. Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.10(3)Art.13(6)	Governance and organisation; Detection…	Loosely related	No mapping. Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.