NIS2 · 13. Environmental and physical security

Supporting utilities

frameworkNIS2 Implementing Regulation (EU) 2024/2690 section13. Environmental and physical security csf 2.0DE.CM-02 DE.CM-06 GV.OC-03 GV.OC-05 ID.RA-10 topicsPhysical Security frameworks6 2 2

Official text · not licensableTitle from ENISA's guidance: Supporting utilities. See the Annex to Implementing Regulation (EU) 2024/2690 for the legal text.

gap from NIS2 → gap to NIS2 →

Wrong or missing mapping? Report it

Equivalents of 13.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-02 PR.AA-06 PR.IR-02	The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk…	Crosswalk	Same topic: Physical Security 4 loosely related (not mappings) DE.CM-06 External service provider activities and services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-06: related, not a mapping GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed Loosely related Only shares CSF GV.OC-03: related, not a mapping GV.OC-05 Outcomes, capabilities, and services that the organization depends on are understood and communicated Loosely related Only shares CSF GV.OC-05: related, not a mapping ID.RA-10 Critical suppliers are assessed prior to acquisition Loosely related Only shares CSF ID.RA-10: related, not a mapping
ISO 27001	A.7.1 A.7.2 A.7.3 A.7.4 A.7.5 A.7.6 A.7.8 A.7.11 A.7.12	Physical security perimeters; Physical entry…	Crosswalk	Same topic: Physical Security 9 loosely related (not mappings) A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-03, ID.RA-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF GV.OC-05: related, not a mapping A.5.8 Information security in project management Loosely related Only shares CSF GV.OC-05: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.RA-10: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-03: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-06: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 1 more in the downloads
CIS v8.1	CIS 15.2 CIS 15.6 CIS 15.4 CIS 15.7	Establish and Maintain a Service Provider Management Policy; Monitor Service Providers…	Loosely related	No mapping. Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping
SOC 2	CC6.4	Physical access restrictions	Editorial	Same topic: Physical Security (editorial pick) 4 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-05: related, not a mapping CC4.1 Ongoing and/or separate evaluations of controls Loosely related Only shares CSF GV.OC-03: related, not a mapping CC4.2 Communicating and remediating control deficiencies Loosely related Only shares CSF GV.OC-03: related, not a mapping
PCI DSS	9.2.3 9.3.1.1 9.2.1 9.2.1.1 9.3.1 9.3.2	Physical access to network hardware restricted; Sensitive-area access authorised and revoked promptly…	Crosswalk	Same topic: Physical Security 18 loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF GV.OC-03, GV.OC-05, ID.RA-10: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF DE.CM-06, GV.OC-03, GV.OC-05: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.OC-03, ID.RA-10: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-03, GV.OC-05: related, not a mapping 12.9.2 Service providers support customer compliance requests Loosely related Only shares CSF GV.OC-03, GV.OC-05: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 10 more in the downloads
CMMC	PE.L2-3.10.1 PE.L2-3.10.2 PE.L2-3.10.3 PE.L2-3.10.4 PE.L2-3.10.5 PE.L2-3.10.6	Limit Physical Access; Monitor Facility…	Crosswalk	Same topic: Physical Security 6 loosely related (not mappings) CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-02, DE.CM-06: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-02, DE.CM-06: related, not a mapping RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF ID.RA-10: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-06: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06: related, not a mapping CA.L2-3.12.1 Security Control Assessment Loosely related Only shares CSF GV.OC-03: related, not a mapping
800-53	PE-2 PE-3 PE-6 PE-8 PE-13 PE-14	Physical Access Authorizations; Physical Access Control…	Crosswalk	Same topic: Physical Security 13 loosely related (not mappings) CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-02, DE.CM-06: related, not a mapping SA-9 External System Services Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping PE-20 Asset Monitoring and Tracking Loosely related Only shares CSF DE.CM-02: related, not a mapping PM-11 Mission and Business Process Definition Loosely related Only shares CSF GV.OC-05: related, not a mapping PM-28 Risk Framing Loosely related Only shares CSF GV.OC-03: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-05: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF DE.CM-06: related, not a mapping RA-7 Risk Response Loosely related Only shares CSF GV.OC-05: related, not a mapping …and 5 more in the downloads
HIPAA	§164.310(a)§164.310(a)(2)(iii)§164.310(b)§164.310(c)§164.310(a)(2)(ii)	Facility Access Controls; Access Control and Validation Procedures…	Crosswalk	Same topic: Physical Security 30 loosely related (not mappings) §164.308(a)(8) Evaluation Loosely related Only shares CSF DE.CM-02, DE.CM-06, GV.OC-03: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-02, DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.OC-05: related, not a mapping §164.310(d) Device and Media Controls Loosely related Only shares CSF DE.CM-02, GV.OC-03: related, not a mapping …and 22 more in the downloads
GDPR	Art.28(1)Art.28(3)Art.5(2)	Processor; Processor…	Loosely related	No mapping. Only shares CSF DE.CM-06, ID.RA-10, GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.6(2)Art.9(4)(c)	ICT risk management framework; Protection and prevention	Editorial	Same topic: Physical Security (editorial pick) 11 loosely related (not mappings) Art.28(3) General principles Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping Art.5(2)(f) Governance and organisation Loosely related Only shares CSF GV.OC-03: related, not a mapping Art.6(6) ICT risk management framework Loosely related Only shares CSF GV.OC-03: related, not a mapping …and 3 more in the downloads
CPS 234	Para 34 Para 16 Para 22 Para 28	Internal audit assesses third-party assurance relied on; Assess third parties' information security capability…	Loosely related	No mapping. Only shares CSF DE.CM-06, GV.OC-03, ID.RA-10: related, not a mapping +2 more loosely related (not mappings) Para 32 Internal audit reviews control design and effectiveness Loosely related Only shares CSF GV.OC-03: related, not a mapping Para 33 Assurance provided by appropriately skilled personnel Loosely related Only shares CSF GV.OC-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.