NIS2 Implementing Regulation (EU) 2024/2690

阅读指南：NIS2合规：实用指南 →

本站所指 NIS2 为《实施条例》(EU) 2024/2690 的技术措施，该条例直接适用于数字基础设施和 ICT 服务提供商；其他 NIS2 实体则遵循其所在国对 Article 21 的转化。事件报告时限（Article 23）不在范围内。ENISA 的映射仅供参考，不具约束力。

对比分析

要求

要求编号和标题均按各框架官方发布的英文原文显示。

NIS2 Implementing Regulation (EU) 2024/2690 项要求

ID	要求	主题	映射于
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	治理政策	9 / 13
1.2	Roles, responsibilities and authorities	角色与职责	9 / 13
2. Risk management policy · 3
2.1	Risk management framework	风险管理, 风险评估	10 / 13
2.2	Compliance monitoring	合规	10 / 13
2.3	Independent review of information and network security	合规	10 / 13
3. Incident handling · 6
3.1	Incident handling policy	事件响应	12 / 13
3.2	Monitoring and logging	持续监控, 日志与审计, 入侵检测, SIEM / SOC	11 / 13
3.3	Event reporting	报告	12 / 13
3.4	Event assessment and classification	异常检测, SIEM / SOC	10 / 13
3.5	Incident response	事件响应, 取证分析, 缓解	12 / 13
3.6	Post-incident reviews	经验教训	9 / 13
4. Business continuity and crisis management · 3
4.1	Business continuity and disaster recovery plan	恢复规划, 业务连续性, 灾难恢复	10 / 13
4.2	Backup management	备份与恢复, 灾难恢复	11 / 13
4.3	Crisis management	沟通, 业务连续性, 沟通与恢复	11 / 13
5. Supply chain security · 2
5.1	Supply chain security policy	供应链风险, 供应商风险管理	10 / 13
5.2	Directory of suppliers and service providers	供应商风险管理	10 / 13
6. Security in acquisition, development and maintenance · 10
6.1	Security in acquisition of ICT services, ICT systems or ICT products	供应链风险, 云安全, 供应商风险管理	12 / 13
6.2	Secure development life cycle	安全开发	8 / 13
6.3	Configuration management	安全配置	9 / 13
6.4	Change management, repairs and maintenance	—	3 / 13
6.5	Security testing	漏洞管理	13 / 13
6.6	Security patch management	补丁管理	10 / 13
6.7	Network security	防火墙 / 网络分段	9 / 13
6.8	Network segmentation	防火墙 / 网络分段, 零信任	9 / 13
6.9	Protection against malicious and unauthorised software	终端防护, 邮件安全	10 / 13
6.10	Vulnerability handling and disclosure	漏洞管理	13 / 13
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	风险管理	10 / 13
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	意识与培训	10 / 13
8.2	Security training	意识与培训	10 / 13
9. Cryptography · 1
9.1	Cryptography	加密	10 / 13
10. Human resources security · 4
10.1	Human resources security	—	1 / 13
10.2	Verification of Background	内部威胁	9 / 13
10.3	Termination or change of employment procedures	—	2 / 13
10.4	Disciplinary process	内部威胁	9 / 13
11. Access control · 7
11.1	Access control policy	访问控制, 零信任	11 / 13
11.2	Management of access rights	访问控制	11 / 13
11.3	Privileged accounts and system administration accounts	特权访问	10 / 13
11.4	Administration systems	特权访问	10 / 13
11.5	Identification	访问控制	11 / 13
11.6	Authentication	多因素认证, 零信任	10 / 13
11.7	Multi-factor authentication	多因素认证	10 / 13
12. Asset management · 5
12.1	Asset classification	数据分类	9 / 13
12.2	Handling of assets	数据保护	11 / 13
12.3	Removable media policy	数据保护, DLP	11 / 13
12.4	Asset inventory	资产管理	13 / 13
12.5	Deposit, return or deletion of assets upon termination of employment	—	2 / 13
13. Environmental and physical security · 3
13.1	Supporting utilities	物理安全	8 / 13
13.2	Protection against physical and environmental threats	物理安全	8 / 13
13.3	Perimeter and physical access control	物理安全	8 / 13

主题覆盖情况

已映射 NIS2 要求的主题（43）：

本站数据中无映射 无 NIS2 要求（7）：