NIS2 vs NIST CSF

Article 21(1) of NIS2 requires measures that take account of relevant European and international standards where applicable, so a NIST CSF 2.0 program can supply much of the technical and governance substance, but it cannot by itself establish compliance. Implementing Regulation (EU) 2024/2690 then adds specifics that a general framework does not state: at least annual management review of the security policy and of risk assessments, quarterly assessment of recurring incidents, and quantified significant incident thresholds. Read the CSF 2.0 Core against those items. Govern maps most directly to the policy, roles and management review obligations, Identify to asset and risk assessment, Protect to access, training and data security, Detect to monitoring, Respond to incident handling, and Recover to restoration and lessons learned. Each mapping still has to be checked against the regulation's wording, and the review dates and incident thresholds need their own owners and records.

ENISA is explicit that its mapping of the implementing regulation to NIST CSF 2.0 is not a measure of equivalence and does not assess whether the framework fully covers the regulation's requirements. In practice, a gap analysis should list each Article 21 measure and each annex point, then record which CSF Subcategory supports it and what evidence an authority could inspect. Expect gaps where CSF is silent on the regulation's own timing rules and on thresholds that must be quantified. The CSF 2.0 Implementation Examples and informative references are published online, not in CSWP 29, so NIST can update them more often than the framework document. Record the version and date of the mapping you used, and confirm with national competent authorities which mappings they accept, since national transposition laws govern enforcement.

Treat the CSF as the organizing structure for the program, then add a NIS2 layer for what it does not cover. Decisions to make now include who in the management body signs off on policy and risk reviews, how quarterly recurring incident reviews are scheduled and minuted, and which reporting timelines apply to each in-scope entity. Ask any assessor or auditor to state in writing whether they will test against the CSF Subcategories, the regulation's annex points, or both, and what evidence format they expect. Because NIST does not offer certification of CSF implementations, the proof you hand to an authority will be your own documented mapping, your audit results from a qualified auditor and the underlying records, not a CSF certificate.

A NIST CSF 2.0 program can produce evidence for several NIS2 duties, but it cannot satisfy the duties that NIS2 places on the entity and on national authorities. Registration with the competent authority under Articles 3 and 27 is a legal filing, not a control outcome. Incident reporting under Article 23 is a set of deadlines: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The CSF's Detect, Respond and Recover Functions help you find and handle incidents, but they do not tell you who to notify, in what format, or by when. Map your incident playbook to the Article 23 clock and confirm the reporting channel and content with each national CSIRT or competent authority where you have entities.

Management body duties under Article 20 are also outside the CSF's control language. The CSF Govern Function gives you a place to record board oversight, but NIS2 requires management bodies to approve the risk-management measures, oversee their implementation and undergo cybersecurity training, and it makes them liable for infringements. Ask your board to confirm who approves the measures, how training is recorded and who holds the accountability for each entity in scope. Those decisions are governance facts that a framework profile cannot make on its own.

Supervision under Articles 32 to 34 is the final gap. Essential entities face ex ante supervision and important entities face ex post supervision, and authorities can run inspections, security audits, scans, information requests and impose administrative fines. NIS2 creates no certificate, so a CSF assessment does not end supervision. Authorities may ask for the results of audits by a qualified auditor and the underlying evidence, so keep a CSF-based evidence file that traces each control to an owner, a test and a dated result. Because NIS2 is a directive, the detailed obligations, registration steps and penalty levels come from each Member State's transposition law, so confirm those rules in every country where you operate before you treat the CSF program as your compliance record.

Keep NIST CSF 2.0 as the common program language for US and EU sites, but treat it as the layer that organizes controls, not as the layer that proves NIS2 compliance. Use the CSF Functions and Categories as the shared vocabulary for policy, risk registers and metrics across all locations. Then add an EU record for each in-scope legal entity, because NIS2 obligations attach to the entity that is classified as essential or important, not to the group. Each EU entity needs its own registration with its competent authority, its own incident reporting procedure with the 24-hour, 72-hour and one-month stages, and a named management body that can show it has approved the risk measures and completed training. A single global program that does not map to those legal entities will leave gaps that an authority can see.

NIS2 is a directive, so the detail is set by national transposition laws. Member States had to transpose it by 17 October 2024, and reporting thresholds, supervisory practice and registration steps can differ from one country to the next. Confirm with local counsel or the relevant national authority for each country where you operate, and record the answers in the EU entity records. Implementing Regulation (EU) 2024/2690 also applies to the covered digital sectors, so check whether any EU entity falls under its specific technical requirements, which go beyond what the CSF Core sets out.

Plan around a pending change. On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council. Before you fix your EU entity map, read the Commission's NIS2 policy page and the proposal itself, and ask counsel whether any entity's classification could change. Build the entity records so that a change in classification updates scope and procedures without restructuring the whole program.