Crosswalk
NIS 2
Where the corpus maps to NIS 2: Cybersecurity of network and information systems.
Canonical citation
- Standard ID
- EU NIS 2 Directive
- Current version
- Directive 2022/2555
- Publication date
- 2022-12
- Topic
- Cybersecurity of network and information systems
- Upstream check location
- https://
eur-lex.europa.eu/ eli/ dir/ 2022/ 2555/ oj (opens in a new tab) - Last verified (UTC)
- 2026-06-30
Mapped control areas, 12
Control areas from the reverse crosswalk
From the Reverse Framework Control Crosswalk Matrix, which answers: given a control identifier or family, which documents address it.
| Article area | Library documents | Alignment type |
|---|---|---|
| Article 21 Cybersecurity risk management measures | Enterprise Risk Management Standard, Information Security Policy, IT Service Management Framework | Regulatory interpretation |
| Article 21.2(a) Policies on risk analysis and information system security | Enterprise Governance and Risk Management Policy, Information Security Policy | Regulatory interpretation |
| Article 21.2(b) Incident handling | Security Incident Response Procedure | Regulatory interpretation |
| Article 21.2(c) Business continuity, backup, crisis management | Business Continuity and Resilience Framework, Backup and Recovery Procedure, Business Continuity and Crisis Management Plan | Regulatory interpretation |
| Article 21.2(d) Supply chain security | Third-Party and Supply Chain Risk Standard, Supplier and Cloud Governance Framework | Regulatory interpretation |
| Article 21.2(e) Security in network and information systems acquisition, development, maintenance | Secure Development and Engineering Policy, Acceptance Into Service Policy | Regulatory interpretation |
| Article 21.2(f) Policies and procedures to assess effectiveness | Control Testing Procedure, Internal Audit Standard | Regulatory interpretation |
| Article 21.2(g) Basic cyber hygiene practices and training | Security Awareness and Training Standard | Regulatory interpretation |
| Article 21.2(h) Cryptography and encryption | Encryption and Key Management Policy, Cryptographic Key Lifecycle Management Framework | Regulatory interpretation |
| Article 21.2(i) Human resources security, access control, asset management | Personnel Security Screening Standard, Identity and Access Management Policy, Asset Inventory Register | Regulatory interpretation |
| Article 21.2(j) Multi-factor authentication, secured communications | Authentication and Password Management Standard, Network Communications Security Policy | Regulatory interpretation |
| Article 23 Reporting obligations | Security Incident Reporting and Escalation Procedure, Security Incident Response Procedure | Regulatory interpretation |
Coverage, 7 domains
Coverage by domain
From the Reverse Framework Control Crosswalk Matrix; the main crosswalk table's document counts land here.
Risk, 3 documents
Compliance, 2 documents
- Control Testing Procedureprocedure
- Internal Audit Standardstandard
Security, 10 documents
- Information Security Policypolicy
- Security Incident Response Procedureprocedure
- Acceptance Into Service Policypolicy
- Security Awareness and Training Standardstandard
- Encryption and Key Management Policypolicy
- Cryptographic Key Lifecycle Management Frameworkframework
- Personnel Security Screening Standardstandard
- Identity and Access Management Policypolicy
- Authentication and Password Management Standardstandard
- Network Communications Security Policypolicy
Operations, 2 documents
- IT Service Management Frameworkframework
- Asset Inventory Registerregister
Supply chain, 1 document
Resilience, 4 documents
Dev security, 1 document
Corpus citations, 20
Documents naming it in their framework alignment
Generated from each document's framework alignment list in the taxonomy, through the committed alias map.
- Concentration Risk RegisterSupply chain
- Cross-Domain Incident Coordination ProcedureResilience
- eIDAS Sector Requirements AnnexCompliance
- Energy and Utilities Sector Requirements AnnexCompliance
- Fourth-Party and Nth-Party Risk ProcedureSupply chain
- IT Service Management FrameworkOperations
- Legal and Regulatory Compliance PolicyCompliance
- Lessons Learned TemplateResilience
- Network Communications Security PolicySecurity
- Network Security and Segmentation StandardOperations
- NIS 2 Implementation AnnexCompliance
- OT Asset Inventory and Lifecycle RegisterOperations
- OT Change Management ProcedureOperations
- OT Incident Response ProcedureOperations
- Pandemic Continuity PlanResilience
- Physical Site Continuity PlanResilience
- Recovery Runbook TemplateResilience
- Service Level Management StandardOperations
- Tabletop Exercise TemplateResilience
- Telecommunications Sector Requirements AnnexCompliance
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.