NIS2 · 12. Asset management

Asset classification

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section12. Asset management csf 2.0ID.AM-05 topicsData Classification frameworks4 5 3

Official text · not licensableTitle from ENISA's guidance: Asset classification. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 12.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-05 ID.AM-07	Assets are prioritized based on classification, criticality, resources, and impact on the mission; Inventories of data and corresponding metadata for designated data types are maintained	Crosswalk	Same topic: Data Classification
ISO 27001	A.5.12 A.5.13 A.5.9	Classification of information; Labelling of information…	Crosswalk	Same topic: Data Classification ENISA NIS2 → ISO 27001 mapping
CIS v8.1	CIS 3.2 CIS 3.7 CIS 3.8	Establish and Maintain a Data Inventory; Establish and Maintain a Data Classification Scheme…	Crosswalk	Same topic: Data Classification
SOC 2	C1.1	Identifying and protecting confidential information	Editorial	Same topic: Data Classification (editorial pick)
PCI DSS	9.4.2	Media classified by data sensitivity	Editorial	Same topic: Data Classification (editorial pick) 5 loosely related (not mappings) 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.AM-05: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Loosely related Only shares CSF ID.AM-05: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Loosely related Only shares CSF ID.AM-05: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF ID.AM-05: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Loosely related Only shares CSF ID.AM-05: related, not a mapping
CMMC	MP.L2-3.8.4	Media Markings	Editorial	Same topic: Data Classification (editorial pick)
800-53	RA-2	Security Categorization	Crosswalk	Same topic: Data Classification 2 loosely related (not mappings) RA-3 Risk Assessment Loosely related Only shares CSF ID.AM-05: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF ID.AM-05: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(7)(ii)(E)§164.316(a)	Risk Analysis; Risk Management…	Loosely related	No mapping. Only shares CSF ID.AM-05: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.8(1)	Identification	Editorial	Same topic: Data Classification (editorial pick)
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Editorial	Same topic: Data Classification (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.