LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / ENISA NIS2 guidance

ENISA NIS2 Technical Implementation Guidance

Below are its 49 requirements in the framework's own order, and under each one the laws we track that bear on it. Each mapping is our reading that a law bears on a requirement, never a finding that running the requirement meets the law.

Its requirements are written from Commission Implementing Regulation (EU) 2024/2690, which the law library holds as a law of its own. That law is left out of the counts below, because read against its own text it would bear on every requirement.

Where the law lands in the framework

21of 49 requirements have law276laws112jurisdictions

1.1: 115 laws in 62 jurisdictions1.1 1151.2: 105 laws in 52 jurisdictions2.1: 110 laws in 70 jurisdictions2.2: 105 laws in 52 jurisdictions2.3: 4 laws in 4 jurisdictions3.1: 201 laws in 103 jurisdictions3.1 2013.2: 115 laws in 62 jurisdictions3.2 1153.3: no law we track3.4: 108 laws in 69 jurisdictions3.5: 114 laws in 73 jurisdictions3.6: 107 laws in 68 jurisdictions4.1: 107 laws in 70 jurisdictions4.2: 11 laws in 11 jurisdictions4.3: 107 laws in 68 jurisdictions5.1: 1 law in 1 jurisdiction5.2: no law we track6.1: no law we track6.2: 107 laws in 70 jurisdictions6.3: no law we track6.4: no law we track6.5: 107 laws in 70 jurisdictions6.6: no law we track6.7: no law we track6.8: no law we track6.9: no law we track6.10: 114 laws in 75 jurisdictions7.1: no law we track8.1: no law we track8.2: no law we track9.1: 107 laws in 70 jurisdictions10.1: no law we track10.2: no law we track10.3: no law we track10.4: no law we track11.1: no law we track11.2: 107 laws in 70 jurisdictions11.3: no law we track11.4: no law we track11.5: no law we track11.6: no law we track11.7: no law we track12.1: no law we track12.2: 11 laws in 11 jurisdictions12.3: no law we track12.4: 105 laws in 52 jurisdictions12.5: no law we track13.1: no law we track13.2: no law we track13.3: no law we track12345678910111213

Of these laws, 253 are in force, 13 not yet in force, and 10 proposed and not law.

7 of the 10 requirements under Security in network and information systems acquisition, development and maintenance have no law we track under them.

  • in force
  • not yet in force
  • blocked by a court
  • proposed
  • no law we track
A bar's height is its number of laws. Select one to open the requirement.

Read through the kinds of duty each cybersecurity law we track carries, counting a kind of duty only where the law's own requirement lines, as read against the NIST Cybersecurity Framework, bear it out.

Policy on the security of network and information systems

2 of 2 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
1.1 Policy on the security of network and information systems 115 laws, 6 not yet in force, 4 proposed 115 62 6 4
1.2 Roles, responsibilities and authorities 105 laws, 6 not yet in force, 4 proposed 105 52 6 4

Risk management policy

3 of 3 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
2.1 Risk management framework 110 laws, 6 not yet in force, 1 proposed 110 70 6 1
2.2 Compliance monitoring 105 laws, 6 not yet in force, 4 proposed 105 52 6 4
2.3 Independent review of information and network security 4 laws 4 4 0 0

Incident handling

5 of 6 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
3.1 Incident handling policy 201 laws, 10 not yet in force, 6 proposed 201 103 10 6
3.2 Monitoring and logging 115 laws, 6 not yet in force, 4 proposed 115 62 6 4
3.3 Event reporting no law we track no law we track
3.4 Event assessment and classification 108 laws, 5 not yet in force, 5 proposed 108 69 5 5
3.5 Incident response 114 laws, 5 not yet in force, 5 proposed 114 73 5 5
3.6 Post-incident reviews 107 laws, 5 not yet in force, 5 proposed 107 68 5 5

Business continuity and crisis management

3 of 3 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
4.1 Business continuity and disaster recovery plan 107 laws, 6 not yet in force, 1 proposed 107 70 6 1
4.2 Backup and redundancy management 11 laws 11 11 0 0
4.3 Crisis management 107 laws, 5 not yet in force, 5 proposed 107 68 5 5

Supply chain security

1 of 2 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
5.1 Supply chain security policy 1 law 1 1 0 0
5.2 Directory of suppliers and service providers no law we track no law we track

Security in network and information systems acquisition, development and maintenance

3 of 10 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
6.1 Security in acquisition of ICT services or ICT products no law we track no law we track
6.2 Secure development life cycle 107 laws, 6 not yet in force, 1 proposed 107 70 6 1
6.3 Configuration management no law we track no law we track
6.4 Change management, repairs and maintenance no law we track no law we track
6.5 Security testing 107 laws, 6 not yet in force, 1 proposed 107 70 6 1
6.6 Security patch management no law we track no law we track
6.7 Network security no law we track no law we track
6.8 Network segmentation no law we track no law we track
6.9 Protection against malicious and unauthorised software no law we track no law we track
6.10 Vulnerability handling and disclosure 114 laws, 6 not yet in force, 1 proposed 114 75 6 1

Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

0 of 1 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures no law we track no law we track

Basic cyber hygiene practices and security training

0 of 2 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
8.1 Awareness raising and basic cyber hygiene practices no law we track no law we track
8.2 Security training no law we track no law we track

Cryptography

1 of 1 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
9.1 Cryptography 107 laws, 6 not yet in force, 1 proposed 107 70 6 1

Human resources security

0 of 4 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
10.1 Human resources security no law we track no law we track
10.2 Verification of background no law we track no law we track
10.3 Termination or change of employment procedures no law we track no law we track
10.4 Disciplinary process no law we track no law we track

Access control

1 of 7 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
11.1 Access control policy no law we track no law we track
11.2 Management of access rights 107 laws, 6 not yet in force, 1 proposed 107 70 6 1
11.3 Privileged accounts and system administration accounts no law we track no law we track
11.4 Administration systems no law we track no law we track
11.5 Identification no law we track no law we track
11.6 Authentication no law we track no law we track
11.7 Multi-factor authentication no law we track no law we track

Asset management

2 of 5 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
12.1 Asset classification no law we track no law we track
12.2 Handling of assets 11 laws 11 11 0 0
12.3 Removable media policy no law we track no law we track
12.4 Asset inventory 105 laws, 6 not yet in force, 4 proposed 105 52 6 4
12.5 Deposit, return or deletion of assets upon termination of employment no law we track no law we track

Environmental and physical security

0 of 3 requirements with law
RequirementWhat it saysLaws, by stateLawsJurisdictionsNot yet in forceProposed
13.1 Supporting utilities no law we track no law we track
13.2 Protection against physical and environmental threats no law we track no law we track
13.3 Perimeter and physical access control no law we track no law we track

Where the law and the framework part

28 of the 49 requirements have no law we track under them.

Kinds of duty this framework has no requirement for: access restriction, age verification, attribution, biometric, consent, content labelling, data subject rights, design code, licensing, prohibition, TDM.

The framework's text

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.

Read it from the publisher: www.enisa.europa.eu