对比

NIS2 与 NIST CSF 2.0 对照：以 NIST 视角看欧盟法律要求

NIST Cybersecurity Framework 2.0 · NIS2 Implementing Regulation (EU) 2024/2690 · 数据截至 2026-10-27

对于以 NIST CSF 2.0 开展安全计划的组织（通常是总部位于美国、在欧盟设有业务的公司）而言，核心问题是 CSF 在多大程度上能帮助其满足 NIS2 的要求。ENISA 的技术实施指南将《实施条例（EU）2024/2690》的每一项要求，既映射到 CSF 2.0 的子类别，也映射到 ISO 27001。

答案是：在技术措施方面，大部分要求都已覆盖。几乎每一项 NIS2 要求都能对应到 CSF 的成果项，只有少数为弱相关。唯一没有对应项的是员工离职时归还或删除资产的要求，ENISA 将其映射到 ISO，但未映射到 CSF。

从 NIS2 反向对照到 CSF，未被对应的 CSF 成果项主要是战略治理类条目，NIS2 并未具体规定这些内容，包括组织使命与战略审查、风险偏好方向、风险沟通渠道以及身份核实。

与 ISO 的情况一样，映射并不等同于合规。NIS2 的法定义务（管理机构的问责与培训、第 23 条规定的事件报告时限、注册登记以及各成员国的转化立法）不属于任何控制框架的范围。

核心要点

一份包含 NIS2 映射子类别的 CSF 目标配置文件（Target Profile），是一份良好的 NIS2 实施计划。
需明确补充欧盟特有的义务：CSIRT 报告时限、管理层培训、国家注册登记。
如果还需要认证，应选择 ISO 27001，因为 CSF 不可认证。

下载此对比（CSV）在差距分析中打开 →

已有 NIST CSF 2.0 → 需要 NIS2

49 项要求

45 项已映射 · · 1 项无映射在差距视图中打开 →

在 49 项 NIS2 Implementing Regulation (EU) 2024/2690 要求中，45 项可映射到 NIST CSF 2.0 中的内容，3 项仅弱相关，1 项在本站数据中无映射。

本站所指 NIS2 为《实施条例》(EU) 2024/2690 的技术措施，该条例直接适用于数字基础设施和 ICT 服务提供商；其他 NIS2 实体则遵循其所在国对 Article 21 的转化。事件报告时限（Article 23）不在范围内。ENISA 的映射仅供参考，不具约束力。

可能需要新增工作：NIS2 项要求在 NIST CSF 2.0 中没有对应映射 (1)

NIS2	要求	匹配	NIST CSF 2.0	证据
12. Asset management · 1
12.5	Deposit, return or deletion of assets upon termination of employment	本站数据中无映射	—	本站数据中没有映射到 NIST CSF 2.0 的内容。

请核查：仅属松散相关（共享同一 CSF 结果，并非映射） (3)

NIS2	要求	匹配	NIST CSF 2.0	证据
6. Security in acquisition, development and maintenance · 1
6.4	Change management, repairs and maintenance	弱相关	ID.RA-07	仅共享 CSF ID.RA-07：属相关关系，并非映射
10. Human resources security · 2
10.1	Human resources security	弱相关	GV.RR-04 PR.AT-02	仅共享 CSF GV.RR-04, PR.AT-02：属相关关系，并非映射
10.3	Termination or change of employment procedures	弱相关	GV.RR-04	仅共享 CSF GV.RR-04：属相关关系，并非映射

已映射 (45)

NIS2	要求	匹配	NIST CSF 2.0	证据
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	对照映射	GV.PO-01 GV.PO-02	相同主题：治理政策
1.2	Roles, responsibilities and authorities	对照映射	GV.RR-01 GV.RR-02 GV.RR-03	相同主题：角色与职责
2. Risk management policy · 3
2.1	Risk management framework	对照映射	GV.RM-01 GV.RM-02 GV.RM-03+5	相同主题：风险管理
2.2	Compliance monitoring	对照映射	GV.OC-03 GV.OV-03	相同主题：合规
2.3	Independent review of information and network security	编辑说明	GV.OC-03 GV.OV-03	相同主题：合规 (编辑推荐)
3. Incident handling · 6
3.1	Incident handling policy	对照映射	ID.IM-04 RS.MA-01 RS.MA-02+2	相同主题：事件响应
3.2	Monitoring and logging	对照映射	DE.AE-02 DE.AE-03 DE.AE-06+5	相同主题：入侵检测, 日志与审计, SIEM / SOC
3.3	Event reporting	对照映射	RS.CO-02	相同主题：报告
3.4	Event assessment and classification	对照映射	DE.AE-02 DE.AE-03 DE.AE-04+3	相同主题：异常检测, SIEM / SOC
3.5	Incident response	对照映射	ID.IM-04 RS.AN-03 RS.AN-06+7	相同主题：事件响应, 取证分析
3.6	Post-incident reviews	对照映射	ID.IM-03 RC.RP-06	相同主题：经验教训
4. Business continuity and crisis management · 3
4.1	Business continuity and disaster recovery plan	对照映射	GV.OC-04 ID.IM-04 PR.IR-03+4	相同主题：业务连续性, 恢复规划, 灾难恢复
4.2	Backup management	对照映射	PR.DS-11 PR.IR-03 RC.RP-02+2	相同主题：备份与恢复, 灾难恢复
4.3	Crisis management	对照映射	GV.OC-04 PR.IR-03 RC.CO-03+4	相同主题：业务连续性, 沟通与恢复
5. Supply chain security · 2
5.1	Supply chain security policy	对照映射	DE.CM-06 GV.SC-01 GV.SC-03+7	相同主题：供应商风险管理, 供应链风险
5.2	Directory of suppliers and service providers	对照映射	DE.CM-06 GV.SC-04 GV.SC-06+2	相同主题：供应商风险管理
6. Security in acquisition, development and maintenance · 9
6.1	Security in acquisition of ICT services, ICT systems or ICT products	对照映射	DE.CM-06 GV.SC-01 GV.SC-03+10	相同主题：供应商风险管理, 供应链风险
6.2	Secure development life cycle	对照映射	PR.PS-06	相同主题：安全开发
6.3	Configuration management	对照映射	PR.PS-01	相同主题：安全配置
6.5	Security testing	对照映射	ID.RA-01 ID.RA-08	相同主题：漏洞管理
6.6	Security patch management	对照映射	PR.PS-02	相同主题：补丁管理
6.7	Network security	对照映射	ID.AM-03 PR.IR-01	相同主题：防火墙 / 网络分段
6.8	Network segmentation	对照映射	ID.AM-03 PR.AA-03 PR.AA-04+2	相同主题：防火墙 / 网络分段, 零信任
6.9	Protection against malicious and unauthorised software	对照映射	DE.CM-09 PR.DS-02 PR.PS-05	相同主题：终端防护, 邮件安全
6.10	Vulnerability handling and disclosure	对照映射	ID.RA-01 ID.RA-08	相同主题：漏洞管理
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	对照映射	GV.RM-01 GV.RM-02 GV.RM-03+1	相同主题：风险管理
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	对照映射	PR.AT-01 PR.AT-02	相同主题：意识与培训
8.2	Security training	对照映射	PR.AT-01 PR.AT-02	相同主题：意识与培训
9. Cryptography · 1
9.1	Cryptography	对照映射	PR.DS-01 PR.DS-02	相同主题：加密
10. Human resources security · 2
10.2	Verification of Background	对照映射	DE.CM-03 GV.RR-04	相同主题：内部威胁
10.4	Disciplinary process	对照映射	DE.CM-03 GV.RR-04	相同主题：内部威胁
11. Access control · 7
11.1	Access control policy	对照映射	PR.AA-01 PR.AA-03 PR.AA-04+2	相同主题：访问控制, 零信任
11.2	Management of access rights	对照映射	PR.AA-01 PR.AA-05	相同主题：访问控制
11.3	Privileged accounts and system administration accounts	对照映射	PR.AA-05	相同主题：特权访问
11.4	Administration systems	对照映射	PR.AA-05	相同主题：特权访问
11.5	Identification	对照映射	PR.AA-01 PR.AA-05	相同主题：访问控制
11.6	Authentication	对照映射	PR.AA-03 PR.AA-04 PR.AA-05+1	相同主题：多因素认证, 零信任
11.7	Multi-factor authentication	对照映射	PR.AA-03	相同主题：多因素认证
12. Asset management · 4
12.1	Asset classification	对照映射	ID.AM-05 ID.AM-07	相同主题：数据分类
12.2	Handling of assets	对照映射	PR.DS-01 PR.DS-02 PR.DS-10	相同主题：数据保护
12.3	Removable media policy	对照映射	PR.DS-01 PR.DS-02 PR.DS-10	相同主题：数据保护, DLP
12.4	Asset inventory	对照映射	ID.AM-01 ID.AM-02 ID.AM-04+1	相同主题：资产管理
13. Environmental and physical security · 3
13.1	Supporting utilities	对照映射	DE.CM-02 PR.AA-06 PR.IR-02	相同主题：物理安全
13.2	Protection against physical and environmental threats	对照映射	DE.CM-02 PR.AA-06 PR.IR-02	相同主题：物理安全
13.3	Perimeter and physical access control	对照映射	DE.CM-02 PR.AA-06 PR.IR-02	相同主题：物理安全

已有 NIS2 → 需要 NIST CSF 2.0

106 项要求

85 项已映射 · · 9 项无映射在差距视图中打开 →

在 106 项 NIST Cybersecurity Framework 2.0 要求中，85 项可映射到 NIS2 中的内容，12 项仅弱相关，9 项在本站数据中无映射。

可能需要新增工作：NIST CSF 2.0 项要求在 NIS2 中没有对应映射 (9)

NIST CSF 2.0	要求	匹配	NIS2	证据
Govern (GV) · 5
GV.OC-01	The organizational mission is understood and informs cybersecurity risk management	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
GV.OV-01	Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
GV.RM-04	Strategic direction that describes appropriate risk response options is established and communicated	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
GV.RM-05	Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
GV.RM-07	Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
Identify (ID) · 2
ID.IM-01	Improvements are identified from evaluations	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
ID.IM-02	Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
Protect (PR) · 2
PR.AA-02	Identities are proofed and bound to credentials based on the context of interactions	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。
PR.IR-04	Adequate resource capacity to ensure availability is maintained	本站数据中无映射	—	本站数据中没有映射到 NIS2 的内容。

请核查：仅属松散相关（共享同一 CSF 结果，并非映射） (12)

NIST CSF 2.0	要求	匹配	NIS2	证据
Detect (DE) · 1
DE.AE-07	Cyber threat intelligence and other contextual information are integrated into the analysis	弱相关	4.3	仅共享 CSF DE.AE-07：属相关关系，并非映射
Govern (GV) · 6
GV.OC-02	Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered	弱相关	1.1	仅共享 CSF GV.OC-02：属相关关系，并非映射
GV.OC-05	Outcomes, capabilities, and services that the organization depends on are understood and communicated	弱相关	5.1 5.2 13.1	仅共享 CSF GV.OC-05：属相关关系，并非映射
GV.OV-02	The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks	弱相关	2.2 2.3	仅共享 CSF GV.OV-02：属相关关系，并非映射
GV.SC-02	Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally	弱相关	1.2	仅共享 CSF GV.SC-02：属相关关系，并非映射
GV.SC-08	Relevant suppliers and other third parties are included in incident planning, response, and recovery activities	弱相关	3.1 4.1	仅共享 CSF GV.SC-08：属相关关系，并非映射
GV.SC-10	Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement	弱相关	5.1	仅共享 CSF GV.SC-10：属相关关系，并非映射
Identify (ID) · 2
ID.RA-02	Cyber threat intelligence is received from information sharing forums and sources	弱相关	2.1 6.10	仅共享 CSF ID.RA-02：属相关关系，并非映射
ID.RA-07	Changes and exceptions are managed, assessed for risk impact, recorded, and tracked	弱相关	6.4	仅共享 CSF ID.RA-07：属相关关系，并非映射
Protect (PR) · 1
PR.PS-03	Hardware is maintained, replaced, and removed commensurate with risk	弱相关	6.10	仅共享 CSF PR.PS-03：属相关关系，并非映射
Respond (RS) · 2
RS.AN-08	An incident's magnitude is estimated and validated	弱相关	3.6	仅共享 CSF RS.AN-08：属相关关系，并非映射
RS.MA-05	The criteria for initiating incident recovery are applied	弱相关	3.1	仅共享 CSF RS.MA-05：属相关关系，并非映射

已映射 (85)

NIST CSF 2.0	要求	匹配	NIS2	证据
Detect (DE) · 10
DE.AE-02	Potentially adverse events are analyzed to better understand associated activities	对照映射	3.2 3.4	相同主题：入侵检测, 异常检测
DE.AE-03	Information is correlated from multiple sources	对照映射	3.2 3.4	相同主题：日志与审计, SIEM / SOC
DE.AE-04	The estimated impact and scope of adverse events are understood	对照映射	3.4	相同主题：异常检测
DE.AE-06	Information on adverse events is provided to authorized staff and tools	对照映射	3.2 3.4	相同主题： SIEM / SOC
DE.AE-08	Incidents are declared when adverse events meet the defined incident criteria	对照映射	3.2 3.4	相同主题： SIEM / SOC
DE.CM-01	Networks and network services are monitored to find potentially adverse events	对照映射	3.2	相同主题：持续监控, 入侵检测
DE.CM-02	The physical environment is monitored to find potentially adverse events	对照映射	13.1 13.2 13.3	相同主题：物理安全
DE.CM-03	Personnel activity and technology usage are monitored to find potentially adverse events	对照映射	3.2 10.2 10.4	相同主题：持续监控, 内部威胁
DE.CM-06	External service provider activities and services are monitored to find potentially adverse events	对照映射	5.1 5.2 6.1	相同主题：供应商风险管理
DE.CM-09	Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events	对照映射	3.2 3.4 6.9	相同主题：持续监控, 异常检测, 终端防护, 邮件安全
Govern (GV) · 20
GV.OC-03	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed	对照映射	2.2 2.3	相同主题：合规
GV.OC-04	Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated	对照映射	4.1 4.3	相同主题：业务连续性
GV.OV-03	Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	对照映射	2.2 2.3	相同主题：合规
GV.PO-01	Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	对照映射	1.1	相同主题：治理政策
GV.PO-02	Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission	对照映射	1.1	相同主题：治理政策
GV.RM-01	Risk management objectives are established and agreed to by organizational stakeholders	对照映射	2.1 7.1	相同主题：风险管理
GV.RM-02	Risk appetite and risk tolerance statements are established, communicated, and maintained	对照映射	2.1 7.1	相同主题：风险管理
GV.RM-03	Cybersecurity risk management activities and outcomes are included in enterprise risk management processes	对照映射	2.1 7.1	相同主题：风险管理
GV.RM-06	A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated	对照映射	2.1 7.1	相同主题：风险管理
GV.RR-01	Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving	对照映射	1.2	相同主题：角色与职责
GV.RR-02	Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced	对照映射	1.2	相同主题：角色与职责
GV.RR-03	Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies	对照映射	1.2	相同主题：角色与职责
GV.RR-04	Cybersecurity is included in human resources practices	对照映射	10.2 10.4	相同主题：内部威胁
GV.SC-01	A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders	对照映射	5.1 6.1	相同主题：供应链风险
GV.SC-03	Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes	对照映射	5.1 6.1	相同主题：供应链风险
GV.SC-04	Suppliers are known and prioritized by criticality	对照映射	5.1 5.2 6.1	相同主题：供应商风险管理
GV.SC-05	Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties	对照映射	5.1 6.1	相同主题：供应链风险
GV.SC-06	Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships	对照映射	5.1 5.2 6.1	相同主题：供应商风险管理
GV.SC-07	The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship	对照映射	5.1 5.2 6.1	相同主题：供应商风险管理
GV.SC-09	Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle	对照映射	5.1 6.1	相同主题：供应链风险
Identify (ID) · 17
ID.AM-01	Inventories of hardware managed by the organization are maintained	对照映射	12.4	相同主题：资产管理
ID.AM-02	Inventories of software, services, and systems managed by the organization are maintained	对照映射	12.4	相同主题：资产管理
ID.AM-03	Representations of the organization's authorized network communication and internal and external network data flows are maintained	对照映射	6.7 6.8	相同主题：防火墙 / 网络分段
ID.AM-04	Inventories of services provided by suppliers are maintained	对照映射	6.1 12.4	相同主题：云安全, 资产管理
ID.AM-05	Assets are prioritized based on classification, criticality, resources, and impact on the mission	对照映射	12.1	相同主题：数据分类
ID.AM-07	Inventories of data and corresponding metadata for designated data types are maintained	对照映射	12.1	相同主题：数据分类
ID.AM-08	Systems, hardware, software, services, and data are managed throughout their life cycles	对照映射	12.4	相同主题：资产管理
ID.IM-03	Improvements are identified from execution of operational processes, procedures, and activities	对照映射	3.6	相同主题：经验教训
ID.IM-04	Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved	对照映射	3.1 3.5 4.1	相同主题：事件响应, 恢复规划
ID.RA-01	Vulnerabilities in assets are identified, validated, and recorded	对照映射	6.5 6.10	相同主题：漏洞管理
ID.RA-03	Internal and external threats to the organization are identified and recorded	对照映射	2.1	相同主题：风险评估
ID.RA-04	Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded	对照映射	2.1	相同主题：风险评估
ID.RA-05	Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization	对照映射	2.1	相同主题：风险评估
ID.RA-06	Risk responses are chosen, prioritized, planned, tracked, and communicated	对照映射	2.1	相同主题：风险评估
ID.RA-08	Processes for receiving, analyzing, and responding to vulnerability disclosures are established	对照映射	6.5 6.10	相同主题：漏洞管理
ID.RA-09	The authenticity and integrity of hardware and software are assessed prior to acquisition and use	对照映射	5.1 6.1	相同主题：供应链风险
ID.RA-10	Critical suppliers are assessed prior to acquisition	对照映射	5.1 5.2 6.1	相同主题：供应商风险管理
Protect (PR) · 19
PR.AA-01	Identities and credentials for authorized users, services, and hardware are managed by the organization	对照映射	11.1 11.2 11.5	相同主题：访问控制
PR.AA-03	Users, services, and hardware are authenticated	对照映射	6.8 11.1 11.6+1	相同主题：零信任, 多因素认证
PR.AA-04	Identity assertions are protected, conveyed, and verified	对照映射	6.8 11.1 11.6	相同主题：零信任
PR.AA-05	Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties	对照映射	6.8 11.1 11.2+4	相同主题：零信任, 访问控制
PR.AA-06	Physical access to assets is managed, monitored, and enforced commensurate with risk	对照映射	13.1 13.2 13.3	相同主题：物理安全
PR.AT-01	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind	对照映射	8.1 8.2	相同主题：意识与培训
PR.AT-02	Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	对照映射	8.1 8.2	相同主题：意识与培训
PR.DS-01	The confidentiality, integrity, and availability of data-at-rest are protected	对照映射	9.1 12.2 12.3	相同主题：加密, 数据保护, DLP
PR.DS-02	The confidentiality, integrity, and availability of data-in-transit are protected	对照映射	6.9 9.1 12.2+1	相同主题：邮件安全, 加密, 数据保护
PR.DS-10	The confidentiality, integrity, and availability of data-in-use are protected	对照映射	12.2 12.3	相同主题：数据保护, DLP
PR.DS-11	Backups of data are created, protected, maintained, and tested	对照映射	4.2	相同主题：备份与恢复
PR.IR-01	Networks and environments are protected from unauthorized logical access and usage	对照映射	6.1 6.7 6.8+2	相同主题：云安全, 防火墙 / 网络分段, 零信任
PR.IR-02	The organization's technology assets are protected from environmental threats	对照映射	13.1 13.2 13.3	相同主题：物理安全
PR.IR-03	Mechanisms are implemented to achieve resilience requirements in normal and adverse situations	对照映射	4.1 4.2 4.3	相同主题：业务连续性, 灾难恢复
PR.PS-01	Configuration management practices are established and applied	对照映射	6.1 6.3	相同主题：云安全, 安全配置
PR.PS-02	Software is maintained, replaced, and removed commensurate with risk	对照映射	6.6	相同主题：补丁管理
PR.PS-04	Log records are generated and made available for continuous monitoring	对照映射	3.2	相同主题：日志与审计
PR.PS-05	Installation and execution of unauthorized software are prevented	对照映射	6.9	相同主题：终端防护
PR.PS-06	Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle	对照映射	6.2	相同主题：安全开发
Recover (RC) · 8
RC.CO-03	Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders	对照映射	4.3	相同主题：沟通与恢复
RC.CO-04	Public updates on incident recovery are shared using approved methods and messaging	对照映射	4.3	相同主题：沟通与恢复
RC.RP-01	The recovery portion of the incident response plan is executed once initiated from the incident response process	对照映射	4.1	相同主题：恢复规划
RC.RP-02	Recovery actions are selected, scoped, prioritized, and performed	对照映射	4.1 4.2	相同主题：恢复规划, 灾难恢复
RC.RP-03	The integrity of backups and other restoration assets is verified before using them for restoration	对照映射	4.2	相同主题：备份与恢复
RC.RP-04	Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms	对照映射	4.1 4.3	相同主题：业务连续性
RC.RP-05	The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed	对照映射	4.1 4.2 4.3	相同主题：灾难恢复, 沟通与恢复
RC.RP-06	The end of incident recovery is declared based on criteria, and incident-related documentation is completed	对照映射	3.6	相同主题：经验教训
Respond (RS) · 11
RS.AN-03	Analysis is performed to establish what has taken place during an incident and the root cause of the incident	对照映射	3.5	相同主题：取证分析
RS.AN-06	Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved	对照映射	3.5	相同主题：取证分析
RS.AN-07	Incident data and metadata are collected, and their integrity and provenance are preserved	对照映射	3.5	相同主题：取证分析
RS.CO-02	Internal and external stakeholders are notified of incidents	对照映射	3.3	相同主题：报告
RS.CO-03	Information is shared with designated internal and external stakeholders	对照映射	4.3	相同主题：沟通
RS.MA-01	The incident response plan is executed in coordination with relevant third parties once an incident is declared	对照映射	3.1 3.5	相同主题：事件响应
RS.MA-02	Incident reports are triaged and validated	对照映射	3.1 3.5	相同主题：事件响应
RS.MA-03	Incidents are categorized and prioritized	对照映射	3.1 3.5	相同主题：事件响应
RS.MA-04	Incidents are escalated or elevated as needed	对照映射	3.1 3.5	相同主题：事件响应
RS.MI-01	Incidents are contained	对照映射	3.5	相同主题：缓解
RS.MI-02	Incidents are eradicated	对照映射	3.5	相同主题：缓解

要求编号和标题均按各框架官方发布的英文原文显示。

对照映射已发布的对照表（NIST、ENISA、CIS、PCI SSC）建立了关联 · 编辑说明在不存在对照表时的 ControlMapping 判断；会显示理由 · 弱相关仅与一项 CSF 2.0 成果共享：值得核查，但不构成映射 · 本站数据中无映射我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 已映射 = 在 ControlMapping 同一主题中被共同归类，或直接关联。对照表并不能证明合规。方法说明 · 下载数据 · 报告错误.

NIS2 与 NIST CSF 2.0 对照：以 NIST 视角看欧盟法律要求

核心要点

已有 NIST CSF 2.0 → 需要 NIS2

已有 NIS2 → 需要 NIST CSF 2.0

按主题