+Annex I national frameworks

Annex I national frameworks

Belgium

Belgium has completed the incorporation of the NIS2 Directive into national legislation. In that legislation, a special role is reserved for the CyberFundamentals framework (CyFun®, www.cyfun.eu ).

Finland

Traficom (the Finnish Transport and Communications Agency) has issued a national recommendation on cybersecurity risk-management measures for supervisory authorities. The Cybermeter/Kybermittari is a maturity model developed by the National Cyber Security Centre (NCSC-FI) and based on the Cybersecurity Capability Maturity Model and the NIST cybersecurity framework. They are the two instrumental documents for the national regulatory framework. The recommended cybersecurity risk-management measures are mapped to the Cybermeter/Kybermittari’s objectives and practices that enable organisations to self-assess their cybersecurity capabilities and optimise their security investments. Voluntarily sharing quantitative self-assessment data to NCSC-FI enables the creation of benchmarking data and improves situational awareness of NCSC-FI.

Germany

In Germany, there is an advisory on what requirements should be seen as state of the art. The document is available at https://www.bsi.bund.de/dok/408936 .

For information on BSI standards and certification, see https://www.bsi.bund.de/dok/it-grundschutz-en .

Greece

Greece has incorporated the NIS2 Directive into national legislation with Law 5160/2024. Furthermore, regarding cybersecurity measures, the Greek national framework consists of the following:

  • ministerial decision 1689/2025 ‘National framework of cybersecurity requirements for essential and important entities’;
  • the Cybersecurity Handbook , available at https://cyber.gov.gr/wp-content/uploads/2025/04/Cybersecurity-Handbook-English-version-1.pdf ;
  • the self-assessment tool, available at https://cyber.gov.gr/wp-content/uploads/2025/03/Cybersecurity-Self-Assessment-Tool-English-version-1.zip .

The Cybersecurity Handbook and the self-assessment tool are based on globally accepted international standards and guidelines (Center for Internet Security Controls, ISO 27002, NIST 800-53, Open Worldwide Application Security Project, etc.) and will be dynamically modified to follow changes in standards, the current threat landscape and the legal and regulatory framework.

Spain

Royal Decree 311/2022, of 3 May 2022, regulates the national security framework, which is a legal regulation that is mandatory for all entities in the Spanish public sector to comply with and is mandatory to apply to the information systems used by private companies to provide services to the abovementioned public entities.

The full text of the framework is available at https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file .

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί