Comparisons anchored on the NIS2 Directive, Directive (EU) 2022/2555: against the Cyber Resilience Act, the GDPR and the NIST CSF.
Entity rules versus product rules: NIS2 obliges essential and important entities to manage cyber risk and report incidents, while the CRA obliges manufacturers of products with digital elements to meet essential requirements and report exploited vulnerabilities. Covers software vendors caught by both, SaaS versus installed software under CRA guidance, reporting channels, and supplier duties.
One incident, two notification regimes: NIS2 covers the security of network and information systems at in-scope entities, the GDPR covers personal data everywhere. Covers NIS2 reporting at 24 hours, 72 hours and one month against the GDPR 72-hour breach notice, how NIS2 Article 35 avoids double fines, who supervises each, and how to run one incident process for both.
For multinationals running one security program across the US and EU: whether a NIST CSF 2.0 program meets NIS2 Article 21. Covers ENISA's mapping of Implementing Regulation 2024/2690 to CSF 2.0 and its warning that mapping is not equivalence, the NIS2 duties a framework cannot cover (registration, incident reporting, management body duties), and how to evidence compliance to authorities.
For entities in NIS2 scope looking for a practical control set: NIS2 sets legal risk-management measures in Article 21 without prescribing controls, the CIS Controls give prioritized Safeguards with a published mapping to NIS2. Covers what the mapping does and does not prove, the NIS2 duties no control set covers, and using CIS IG1 to IG3 as the implementation layer.
How maximum fines compare for organizations covered by both: NIS2 minimum maximums for essential and important entities set through national law, against the two GDPR tiers that apply directly. Covers what each tier is triggered by, who imposes fines, management body accountability under NIS2, and why one incident can expose an entity to both.
For software and device makers that are also NIS2 entities: NIS2 reports significant incidents affecting the entity's services to its CSIRT, the Cyber Resilience Act reports actively exploited vulnerabilities and severe incidents in products through ENISA's Single Reporting Platform. Compares triggers, the 24-hour, 72-hour and final report stages, recipients and the SME exemptions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.