How the mapping is made

NIS2 Art 20 Management approves and oversees security measures · intersects

Article 20 makes management approve and oversee cyber security measures. A named lead who reports to the owners is how a small firm does this day to day, but the legal duty stays with management.

NIS2 21(2)(a) Risk analysis and security policies · supports

This measure asks for security policies. The Commission’s implementing rules for it include defining security roles and responsibilities (Implementing Regulation 2024/2690, Annex §1.2).

ISO 27001 Cl 5.1 Leadership and commitment · supports

Top management must show leadership for the management system. A named lead reporting to them is one visible sign of it.

ISO 27001 A.5.2 Security roles and responsibilities · supports

The control asks for security roles to be defined and given to people. Naming a lead is the first of those roles.

NIST CSF 2.0 GV.RR Roles and responsibilities · subset

Naming a lead sets one of the security roles this outcome asks you to establish and communicate.

NIST CSF 2.0 GV.OV Oversight · supports

Regular reports from the lead give the owners results to review and act on, which is what oversight means here.

NIS2 21(2)(a) Risk analysis and security policies · subset

A written security policy is the information system security half of this measure.

ISO 27001 A.5.1 Security policies · supports

A short security policy that is approved and shared with staff is what this control is about.

NIST CSF 2.0 GV.PO Policy · subset

A written policy that staff have read covers “established” and “communicated”. Enforcing and reviewing it are the rest of this category.

NIS2 21(2)(a) Risk analysis and security policies · supports

Risk analysis is named in this measure. A yearly risk review is its practical form.

NIS2 21(2)(f) Checking whether measures work · supports

A yearly review that also checks whether your measures worked is one way to assess their effectiveness.

GDPR 32(1)(d) Regularly testing security measures · supports

Article 32(1)(d) asks for regular checks on whether security measures work. A yearly review counts towards this when it also looks at how well your measures performed.

ISO 27001 Cl 6.1.2 Assessing information security risks · supports

The clause asks for a defined, repeatable way of assessing information security risks.

NIST CSF 2.0 GV.RM Risk management strategy · supports

Reviewing risks the same way each year is a simple form of a standard method for rating and prioritising them.

NIST CSF 2.0 ID.RA Risk assessment · subset

Listing what could go wrong, how likely and how bad it would be, and deciding what to do about it, is what these outcomes describe.

NIST CSF 2.0 ID.IM Improvement · supports

Repeating the review each year is a simple way to find improvements.

NIS2 21(2)(i) People security, access control and assets · subset

Asset management is named in this measure. An inventory of devices and data is one part of it.

GDPR Art 30 Records of processing · supports

Knowing what data you hold is the starting point for a record of processing. Article 30 asks for more, such as purposes, recipients and how long data is kept. Firms under 250 staff are exempt only if their processing is occasional, low-risk and avoids special-category data, so most small firms still need a record (Art 30(5)).

ISO 27001 A.5.9 Knowing your information and assets · subset

The control asks for an inventory of information and other assets, with owners. A list of devices and data is the core of it.

NIST CSF 2.0 ID.AM Asset management · subset

A list of devices, software, accounts and data is the inventory these outcomes ask for.

NIS2 21(2)(d) Supply chain security · supports

Supply chain security is named in this measure, and Article 21(3) asks you to consider each direct supplier. You cannot do either without a list.

GDPR Art 28 Contracts with processors · supports

Knowing which suppliers hold personal data tells you which ones need a processor contract and sufficient guarantees. The list on its own is not the contract.

ISO 27001 A.5.19 Security with suppliers · subset

The control asks you to manage security risks from suppliers. Knowing who they are is the first part.

ISO 27001 A.5.20 Security in supplier contracts · supports

You need to know your key suppliers before you can put security terms in their contracts.

NIST CSF 2.0 GV.OC Understanding your organisation's context · supports

Listing the suppliers you rely on is a practical way to understand the services your business depends on.

NIST CSF 2.0 GV.SC Supply chain risk · subset

Knowing your suppliers, and which ones are critical, is this outcome almost word for word.

NIST CSF 2.0 ID.AM Asset management · supports

A supplier list that records what each supplier provides is an inventory of supplier services.

NIS2 Art 20 Management approves and oversees security measures · supports

Article 20(2) requires training for management and encourages regular, similar training for all staff.

NIS2 21(2)(g) Basic cyber hygiene and training · subset

Cyber security training is named in this measure, alongside basic cyber hygiene.

ISO 27001 A.6.3 Security awareness and training · equal

The control and the practice describe the same thing: regular security awareness and training for staff.

NIST CSF 2.0 PR.AT Awareness and training · subset

Yearly training for all staff is this outcome for general staff. Training for specialised roles is the rest of the category.

NIS2 21(2)(i) People security, access control and assets · supports

Human resources security and access control are named in this measure.

ISO 27001 A.5.15 Access control rules · supports

Giving people only the access they need applies access control rules.

ISO 27001 A.5.18 Giving and removing access rights · supports

The control is about giving, reviewing and removing access rights.

ISO 27001 A.6.1 Background checks for staff · supports

This control is about background checks before someone joins. Your joiner process is where those checks would sit, but giving access on time does not meet it by itself. This is a weaker link.

ISO 27001 A.6.5 Security duties after someone leaves · supports

Removing access on the last day is part of making security duties continue after someone leaves.

NIST CSF 2.0 GV.RR Roles and responsibilities · supports

Building access changes into hiring and leaving is a way of including security in HR practices.

NIST CSF 2.0 PR.AA Identity and access · supports

Giving people only the access they need, and removing it when they leave, is managing access permissions with least privilege.

NIS2 21(2)(i) People security, access control and assets · supports

Access control is named in this measure. The Commission’s implementing rules for it include multi-factor authentication (2024/2690, Annex §11.7).

NIS2 21(2)(j) Multi-factor authentication and secure communications · subset

Multi-factor authentication is named directly in this measure, which also covers secured voice, video and text communications. The measure applies where appropriate.

GDPR 32(1)(b) Ongoing confidentiality, integrity and resilience · supports

A second sign-in step blocks most account takeovers, which helps keep systems confidential.

ISO 27001 A.5.17 Looking after passwords and other secrets · supports

Protecting sign-in secrets is part of this control. A second factor reduces the harm of a stolen password.

ISO 27001 A.8.5 Secure sign-in · supports

The control is about secure ways of signing in. Multi-factor authentication is a common example.

NIST CSF 2.0 PR.AA Identity and access · supports

This outcome is about authenticating users. A second factor makes that authentication much stronger.

NIS2 21(2)(g) Basic cyber hygiene and training · supports

The recitals list password practices among basic cyber hygiene (recital 49). A password manager is a practical way to follow them.

NIS2 21(2)(i) People security, access control and assets · supports

Access control is named in this measure. The Commission’s implementing rules for it include authentication and managing passwords (2024/2690, Annex §11.6).

ISO 27001 A.5.17 Looking after passwords and other secrets · supports

The control is about handing out and looking after passwords and other secrets.

NIST CSF 2.0 PR.AA Identity and access · supports

A password manager is one way to manage the credentials people use to sign in.

NIS2 21(2)(e) Security when buying, building and maintaining systems · supports

Applying security updates is part of maintaining systems and handling vulnerabilities, which this measure names. The implementing rules include security patch management (2024/2690, Annex §6.6).

NIS2 21(2)(g) Basic cyber hygiene and training · supports

The recitals name software updates as a basic cyber hygiene practice (recitals 49 and 89).

GDPR 32(1)(b) Ongoing confidentiality, integrity and resilience · supports

Fixing known weaknesses helps keep systems confidential, intact and available.

ISO 27001 A.8.8 Fixing technical weaknesses · supports

The control is about finding and fixing technical weaknesses in good time.

NIST CSF 2.0 PR.PS Platform security · supports

Keeping software and hardware updated is maintaining them in line with the risk.

NIS2 21(2)(h) Cryptography and encryption · supports

This measure asks for policies on cryptography and, where appropriate, encryption. Encrypting laptops and phones is one use of them.

GDPR 32(1)(a) Pseudonymisation and encryption · intersects

Encryption is named in Article 32(1)(a), which also covers pseudonymisation. Device encryption is one use of it.

GDPR Art 34 Telling affected people about a high-risk breach · supports

If a lost device was encrypted, you may not have to tell every affected person about the breach: Article 34(3)(a) names encryption as a protection that can remove that duty.

ISO 27001 A.8.1 Laptops and phones used for work · supports

Protecting laptops and phones used for work is the subject of this control.

ISO 27001 A.8.24 Use of cryptography · supports

The control is about using cryptography in a planned way.

NIST CSF 2.0 PR.DS Data security · subset

Encrypting laptops and phones protects the confidentiality of data at rest.

NIS2 21(2)(e) Security when buying, building and maintaining systems · supports

The Commission’s implementing rules for this measure include protection against malicious software (2024/2690, Annex §6.9).

ISO 27001 A.8.1 Laptops and phones used for work · supports

Protecting laptops and phones used for work is the subject of this control.

ISO 27001 A.8.7 Protection against malware · supports

The control is about protection against malware.

NIST CSF 2.0 PR.PS Platform security · supports

Malware protection stops unauthorised software from installing and running.

NIST CSF 2.0 DE.CM Continuous monitoring · supports

Malware protection watches devices and their data for signs of attack.

NIS2 21(2)(b) Incident handling · supports

Handling incidents depends on spotting them. The implementing rules for incident handling include monitoring and logging (2024/2690, Annex §3.2).

GDPR 32(1)(b) Ongoing confidentiality, integrity and resilience · supports

Seeing unusual sign-ins helps protect the confidentiality and integrity of systems.

ISO 27001 Cl 9.1 Monitoring and measurement · supports

Logs give you evidence for monitoring and measuring how security is working.

ISO 27001 A.8.15 Keeping logs · supports

The control is about producing, keeping and protecting logs.

ISO 27001 A.8.16 Watching for unusual activity · supports

The control is about watching systems for unusual behaviour and acting on it.

NIST CSF 2.0 PR.PS Platform security · supports

Turning on sign-in and change logs is generating log records for monitoring.

NIST CSF 2.0 DE.CM Continuous monitoring · supports

Logs and alerts are how sign-ins and system use are monitored.

NIST CSF 2.0 DE.AE Analysing unusual events · supports

Someone looking at the alerts is the start of analysing unusual events.

NIS2 21(2)(b) Incident handling · supports

Incident handling is named in this measure.

GDPR Art 33 Telling the DPC about a breach within 72 hours · supports

Article 33(5) asks you to document every personal data breach, its effects and what you did. A plan makes sure that happens.

ISO 27001 A.5.24 Getting ready for incidents · supports

The control is about planning and preparing for incidents, including roles.

ISO 27001 A.5.26 Responding to incidents · supports

A written plan sets out how you will respond.

NIST CSF 2.0 ID.IM Improvement · subset

Having a written incident response plan, and keeping it up to date, is this outcome.

NIST CSF 2.0 RS.MA Incident management · supports

This category is about running the plan once an incident is declared. Having the plan comes first.

NIST CSF 2.0 RS.AN Incident analysis · supports

A good plan says who works out what happened and why.

NIST CSF 2.0 RS.MI Incident mitigation · supports

A good plan says how to contain the damage and clear it up.

NIS2 Art 23 Reporting significant incidents · supports

Article 23 sets stages for reporting significant incidents: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. An intermediate report may be requested. If the incident is still ongoing when the final report is due, a progress report is sent then and the final report within one month of handling the incident. Knowing who to tell, including affected customers, is the first step.

GDPR Art 33 Telling the DPC about a breach within 72 hours · intersects

Article 33 asks you to tell the Data Protection Commission about a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. If you are later, you must explain why. Having the contact ready makes the deadline realistic.

GDPR Art 34 Telling affected people about a high-risk breach · supports

When a breach is likely to cause high risk, you must tell the people affected. Knowing how to reach them is part of being ready.

ISO 27001 A.5.26 Responding to incidents · supports

Responding to incidents includes telling the right people.

NIST CSF 2.0 RS.CO Incident reporting and communication · supports

Knowing who to tell, inside and outside the business, is what makes this outcome possible.

NIS2 21(2)(c) Business continuity, backups and crisis management · subset

Backup management is named in this measure, which also covers disaster recovery and crisis management.

NIS2 21(2)(g) Basic cyber hygiene and training · supports

The recitals list backing up data among basic cyber hygiene practices (recital 49).

GDPR 32(1)(c) Restoring access to data after an incident · supports

Backups are what make it possible to restore access to personal data after an incident.

ISO 27001 A.8.13 Backups · subset

The control asks for backups to be kept and tested. Daily automatic copies are the first part.

NIST CSF 2.0 PR.DS Data security · subset

In CSF 2.0, backups are a data security outcome: they are created, protected, maintained and tested.

NIS2 21(2)(c) Business continuity, backups and crisis management · supports

A tested restore is part of disaster recovery, which this measure names.

NIS2 21(2)(f) Checking whether measures work · supports

Testing a restore is a direct way to check that a measure works.

GDPR 32(1)(c) Restoring access to data after an incident · supports

Article 32(1)(c) asks for the ability to restore access to personal data in a timely manner after an incident. A restore you have tested and timed is direct evidence of that ability.

GDPR 32(1)(d) Regularly testing security measures · supports

A restore test is one example of regularly testing a security measure.

ISO 27001 A.8.13 Backups · supports

The control expects backups to be tested.

NIST CSF 2.0 ID.IM Improvement · supports

Timing a restore tells you what to improve.

NIST CSF 2.0 PR.DS Data security · supports

This outcome names testing backups. A restore is the test that matters.

NIST CSF 2.0 RC.RP Carrying out the recovery plan · supports

A restore you have tested is a rehearsal of recovery: checking a backup is sound and bringing data back.

NIS2 21(2)(c) Business continuity, backups and crisis management · subset

Business continuity is named in this measure, alongside backups, disaster recovery and crisis management.

GDPR 32(1)(b) Ongoing confidentiality, integrity and resilience · supports

Article 32(1)(b) includes the resilience of systems and services.

ISO 27001 A.5.29 Staying secure during disruption · supports

The control is about keeping security in place during a disruption.

ISO 27001 A.5.30 IT ready for business continuity · supports

The control is about making sure IT is ready to support continuity.

NIST CSF 2.0 PR.IR Infrastructure resilience · supports

A continuity plan sets out your resilience requirements. This category asks for mechanisms that meet them, such as spare equipment or a second way to work.

NIST CSF 2.0 RC.RP Carrying out the recovery plan · supports

A continuity plan sets out which recovery actions come first.

NIST CSF 2.0 RC.CO Recovery communication · supports

A good plan says how you would tell staff and customers during recovery.