NIS2 Technical Implementation Guidance

Under the NIS2 Directive, EU member states set requirements for cybersecurity risk management measures at national level in critical sectors, for example digital infrastructures, energy, transport or health. However, for several subsectors of the digital infrastructures and the ICT service management sectors, these requirements are set at European Union level due to their cross-border nature. For this purpose, the European Commission published the Implementing Regulation (EU) 2024/2690 on 17 October 2024 (1), which lays down the technical and methodological requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555. The technical and methodological requirements are set out in Article 2 and in the Annex to this implementing regulation.

This technical guidance supports this implementing regulation by providing:

• guidance, that is, indicative and actionable advice on parameters to consider when implementing a requirement;
• examples of evidence, that is, the types of evidence that a requirement is in place; and
• mappings from security requirements to industry good practices, European and international standards, and national frameworks.

The document, as well as the implementing regulation, refers to the following type of entities:

• domain name system service providers,
• top-level domain name registries,
• cloud computing service providers,
• data centre service providers,
• content delivery network providers,
• managed service providers and managed security service providers,
• providers of online marketplaces, online search engines and social networking services platforms and
• trust service providers.

The document covers the following technical and methodological requirements:

1. policy on the security of network and information systems, 2. risk management policy, 3. incident handling, 4. business continuity and crisis management, 5. supply chain security, 6. security in network and information systems acquisition, development and maintenance, 7. policies and procedures to assess the effectiveness of cybersecurity risk-management measures, 8. basic cyber hygiene practices and security training, 9. cryptography, 10. human resources security, 11. access control, 12. asset management and 13. environmental and physical security.

To develop this technical guidance, ENISA worked closely with the European Commission and the Network and Information Systems Cooperation Group, and ENISA held a public consultation to get input from the private sector. This guidance is a living document because it maps the technical and methodological requirements referred to in Article 2 and the Annex to the implementing regulation, to European and international standards and to national cybersecurity management frameworks. Both the standards and the management frameworks are constantly subject to change. Therefore, a review process should be initiated at regular intervals by ENISA in collaboration with the European Commission and the Network and Information Systems Cooperation Group, for instance to add additional mappings industry good practices, international standards and national frameworks.

DISCLAIMER

This document is not legally binding and is only of an advisory character. It is not intended to replace the frameworks, guidance, tools or other mechanisms provided by Member States at national level.

It should be clarified that the Member States retain the freedom to determine their approach to the supervision of the requirements under this implementing regulation. Therefore, this ENISA technical guidance is not able to define whether an entity needs to have all or just some of the ‘evidence’ listed (although requiring all the ‘evidence’ listed here would be a very strict approach to supervision). This document also does not determine the appropriateness of such measures or evidence. However, it can help the national competent authorities develop their approach to the supervision of the requirements.

Entities in scope of the regulation should check under whose jurisdiction they fall and they should follow any guidance by national competent authorities (see recital 7 of the implementing regulation).

Background

On 18 October 2024, the European Commission published Commission Implementing Regulation 2024/2690 of 17 October 2024, hereafter the regulation , pursuant to Articles 21(5), first subparagraph and 23(11), second subparagraph, of Directive (EU) 2022/2555 (hereafter the NIS2 Directive). Article 2 of this regulation specifies that, for the essential and important entities in scope of the regulation (hereafter ‘relevant entities’), the technical and methodological requirements of cybersecurity risk-management measures referred to in Article 21(2), points (a) to (j), of the NIS2 Directive are set out in the Annex to the regulation .

According to recital 7, the European Union Agency for Cybersecurity (ENISA) can support relevant entities by providing guidance on the implementation of the technical and methodological requirements referred to in the Annex to the regulation. This implementation guidance was developed by ENISA is collaboration with the Network and Information Systems Cooperation Group (NIS CG) and the European Commission. ENISA published an early draft of this guidance as part of a public consultation, to solicit feedback and input from the private sector. ENISA also consulted with various relevant workstreams of the NIS Cooperation group, as well as the ENISA expert group for European Competent Authorities for Trust Services (ECATS) and the ENISA expert group for European Competent Authorities for Secure Electronic Communications (ECASEC).

Goal

The document provides non-binding guidance for relevant entities to the regulation on the technical and methodological requirements of the cybersecurity risk management measures.

Target audience

Beyond the relevant entities to the regulation, this guidance may provide indications on the technical and methodological requirements of the cybersecurity risk management measures of the NIS2 Directive, which may be considered useful by other public or private bodies for improving their cybersecurity.

Structure

The Annex to the regulation consists of 13 titles with a varying number of technical and methodological requirements (see Figure 1). Each technical and methodological requirement is highlighted (blue font and grey background) and is included in this document for readability.

Each requirement is followed by three elements: guidance, examples of evidence and tips (2). This part of the document is not legally binding and is only recommendations (3).

1. The guidance section contains indicative and actionable advice on parameters to consider when implementing a technical and methodological requirement or further explanation of concepts found in the legal text. 2. Examples of evidence are indicative types of evidence showing that a technical and methodological requirement is in place.

3. In some technical and methodological requirements, extra general tips are also offered for additional consideration by the entity.

Figure 1: Technical and methodological requirements of the cybersecurity risk-management measures

(Annex to Commission Implementing Regulation 2024/2690)

Figure 2: Technical and methodological measures structure

The guidance, examples of evidence and tips are non-exhaustive. Their partial or complete implementation does

not assume compliance or conformity with the requirements of the regulation. Relevant entities may choose alternative methods to fulfil a requirement or use different evidence to demonstrate compliance. Moreover, a single piece of evidence may support various requirements; for example, an organisational chart can demonstrate both ‘roles and responsibilities’ and ‘segregation of duties’. Consequently, evidence may appear multiple times within the text.

Finally, each requirement is mapped to (a) requirements of European and international standards or frameworks (International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27001:2022, ISO/IEC 27002:2022 (4), NIST Cybersecurity Framework 2.0, ETSI EN 319 401 V3.1.1 (2024–06), European Committee for Standardization Technical Specification (CEN/TS) 18026:2024) and (b) to the NIS2 national frameworks (5) . The mapping to standards and frameworks is available on the ENISA website in Excel format (6). It should be noted that the mapping was done only to horizontal standards and for specific topics. Detailed standards or technical specifications are referenced in footnotes, where available. These standards are included as examples, as they are commonly used. The choice of which standards and good practices to apply should be made by the entity, as they may relate to the context of the entity’s activities and characteristics.

To implement the requirements, the relevant entities may build upon their current usage of standards or frameworks, if available. Annex I of this document provides details for each national framework submitted to ENISA during the consultation phases, while some terms are explained in Annex II. The document does not aim to establish a new standard or to duplicate existing ones (e.g. ISO, IEC and CEN). The guidance is written in a technology-neutral and standards-neutral way.

The mapping should not be interpreted as a measure of equivalency among different standards or frameworks. It simply refers to relevant requirements in these standards or frameworks without assessing whether these fully cover the requirements of the regulation. Cybersecurity standards or frameworks often address the same cybersecurity concerns but use different language, structures or levels of specificity or detail. Understanding these relationships may help relevant entities use and integrate multiple standards or frameworks efficiently, to maintain compliance, reduce duplication and streamline audits.

Relevant entities subject to the regulation can use national frameworks, guidance, standards or other mechanisms equivalent to the requirements of the regulation to demonstrate their compliance to national competent authorities. Depending on the national framework, compliance with the requirements set out by the regulation could be demonstrated by means of assessment or certification by relevant accredited conformity assessment bodies or by independent auditors authorised by the national competent authorities or certification bodies authorised by the national competent authorities, against the national frameworks, guidelines, standards or other mechanisms equivalent to technical and methodological requirements for cybersecurity risk-management measures. To keep the current guidance up to date, Member States can inform ENISA of those equivalent national frameworks, guidance, standards or other mechanisms, if available.

Topic-specific policies As described in preamble 9 of the regulation, the policy on the security of network and information systems (7)

(Annex to the regulation, point 1.1) should be the highest-level document setting out the relevant entities’ overall approach to the security of their network and information systems and should be approved by the management bodies of the entities.

In addition to this overarching corporate policy, the following topic-specific, documented policies (8) are required.

1. Risk management policy (Annex to the regulation, point 2). 2. Incident handling policy (Annex to the regulation, point 3.1.1). 3. Supply chain security policy (Annex to the regulation, point 5.1.1). 4. Security testing policy (Annex to the regulation, point 6.5.1).

5. Policy to assess the effectiveness of cybersecurity risk management measures (Annex to the regulation,

point 7.1.1). 6. Policy related to cryptography (Annex to the regulation, point 9.1). 7. Access control policy (Annex to the regulation, point 11.1.1).

8. Policies for the management of privileged accounts and system administration accounts (Annex to the

regulation, point 11.3) 9. Handling of information and assets policy (Annex to the regulation, point 12.2.1). 10. Removable media policy (Annex to the regulation, point 12.3.1).

Documenting the aforementioned topic-specific policies is mandatory. However, the relevant entity should use its discretion to determine the format of documentation, whether it be through separate documents, updates to existing policies or a single comprehensive document.

Policy on the security of network and information systems

Risk management policy

Incident handling

Business continuity and crisis management

Supply chain security

Security in network and information systems acquisition, development and maintenance

Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

Basic cyber hygiene practices and security training

Cryptography

Human resources security

Access control

Asset management

Environmental and physical security

Belgium

Belgium has completed the incorporation of the NIS2 Directive into national legislation. In that legislation, a special role is reserved for the CyberFundamentals framework (CyFun®, www.cyfun.eu ).

Finland

Traficom (the Finnish Transport and Communications Agency) has issued a national recommendation on cybersecurity risk-management measures for supervisory authorities. The Cybermeter/Kybermittari is a maturity model developed by the National Cyber Security Centre (NCSC-FI) and based on the Cybersecurity Capability Maturity Model and the NIST cybersecurity framework. They are the two instrumental documents for the national regulatory framework. The recommended cybersecurity risk-management measures are mapped to the Cybermeter/Kybermittari’s objectives and practices that enable organisations to self-assess their cybersecurity capabilities and optimise their security investments. Voluntarily sharing quantitative self-assessment data to NCSC-FI enables the creation of benchmarking data and improves situational awareness of NCSC-FI.

Germany

In Germany, there is an advisory on what requirements should be seen as state of the art. The document is available at https://www.bsi.bund.de/dok/408936 .

For information on BSI standards and certification, see https://www.bsi.bund.de/dok/it-grundschutz-en .

Greece

Greece has incorporated the NIS2 Directive into national legislation with Law 5160/2024. Furthermore, regarding cybersecurity measures, the Greek national framework consists of the following:

• ministerial decision 1689/2025 ‘National framework of cybersecurity requirements for essential and important entities’;
• the Cybersecurity Handbook , available at https://cyber.gov.gr/wp-content/uploads/2025/04/Cybersecurity-Handbook-English-version-1.pdf ;
• the self-assessment tool, available at https://cyber.gov.gr/wp-content/uploads/2025/03/Cybersecurity-Self-Assessment-Tool-English-version-1.zip .

The Cybersecurity Handbook and the self-assessment tool are based on globally accepted international standards and guidelines (Center for Internet Security Controls, ISO 27002, NIST 800-53, Open Worldwide Application Security Project, etc.) and will be dynamically modified to follow changes in standards, the current threat landscape and the legal and regulatory framework.

Spain

Royal Decree 311/2022, of 3 May 2022, regulates the national security framework, which is a legal regulation that is mandatory for all entities in the Spanish public sector to comply with and is mandatory to apply to the information systems used by private companies to provide services to the abovementioned public entities.

The full text of the framework is available at https://ens.ccn.cni.es/es/docman/documentos-publicos/39-boe-a-2022-7191-national-security-framework-ens/file .

Asset: anything that is of value to the entity, including information. Overall, the assets of a network and information system are personnel, processes, information, software and hardware.

Crisis: an abnormal or extraordinary event or situation that threatens an organisation or community and requires a strategic, adaptive and timely response to preserve its viability and integrity (110).

Critical: one of the classification levels assigned to the entity’s assets following an assessment of their criticality, including the asset classification (Annex to the regulation, point 12.1).

Cyber hygiene practices (111) :

• Cyber hygiene practices for essential and important entities are a common baseline set of network and information security practices, which are already covered by the technical and methodological requirements of the cybersecurity risk-management measures outlined in the Annex to the regulation. Therefore, no additional guidance on cyber hygiene practices for essential and important entities is deemed necessary.
• Cyber hygiene practices relating to users are a set of routine, proactive practices and behaviours that the entity’s users follow to maintain the network and information security of the entity’s systems. These practices are explicitly mentioned in the guidance of section 8.1.

Direct suppliers and service providers: any entity providing ICT products, ICT systems or ICT services that an essential or important entity relies on. When this guidance refers to direct suppliers and service providers, it includes their personnel.

Entity: one of the relevant entities in the scope of Commission Implementing Regulation (EU) 2024/2690. In other standards or good practice guides, the term ‘organisation’, ‘enterprise’ or ‘business’ may be used. Event: in reference to an information security event, an identified occurrence indicating a possible information security breach or failure of controls (112). Facilities: the physical location housing the entity’s network and information systems.

Incident handling: any actions and procedures aiming to prevent, detect, analyse and contain, or to respond to and recover from, an incident (NIS2 Directive Article 6(8)).

Incident: an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible through, network and information systems (NIS2 Directive Article 6(6)).

Information: data in context. In the text, we primarily use ‘information’, unless we refer specifically to data (‘data breach’ etc.).

Management bodies: the highest-level leadership within essential and important entities as in the context of Article 20 of the NIS2 Directive.

Measure: a cybersecurity risk-management measure as referred to in the NIS2 Directive. The word is used similarly to ‘control’, which denotes a measure that modifies risk (113). In addition, the terms ‘measure’ and ‘protection measure’ are used interchangeably.

Personnel: persons doing work under the entity’s direction (114). The concept of personnel includes the entity’s members, such as the governing body, management bodies, employees, temporary staff, contractors and volunteers. In this document it is used interchangeably with the term ‘employees’.

Policy: intentions and direction of an organisation, as formally expressed by its management bodies. Privileged access: the necessary permissions granted to specific users of the network and the information system of the entity, in order for them to perform tasks that regular users cannot. Procedure: a specified way to carry out an activity or a process (115). The entity can document its needs for more detailed information in a way that is efficient for it beyond the policy. These are mainly procedures and processes.

Process: an activity that transforms input into output. Rule: accepted principle or instruction that states the entity’s expectations of what is required to be done and what is allowed or not allowed. Rules can be formally expressed in topic-specific policies and in other types of documents (116).

Significant incident: an incident that meets the criteria of Article 3 of the regulation.

Suspicious event: an event that appears unusual or a previously unknown situation that might be a potential security threat. To make clearer the difference between an event and a suspicious event, consider an example where a legitimate user fails to log in once due to a typing error. This is an event. However, a situation where a user fails to log in after five attempts might be considered a suspicious event.

Topic-specific policy: a policy on a specific subject or topic, as formally expressed by the management bodies relevant to the topic.

User: all legal and natural persons that have access to the entity’s network and information systems (recital 10 of the regulation).