Law / Frameworks / ENISA NIS2 guidance / Risk management policy
ENISA NIS2 guidance 2.3Independent review of information and network security
The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 2.3
We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of .
The kinds of duty that reach it: DPIA.
- 4
- laws
- 4
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST CSF 2.0ID.IM-01 Improvements are identified from evaluations, 3 laws
- FINOS AIGFAIR-PREV-005 System Acceptance Testing, 4 laws
Product security requirements
2 laws, 2 jurisdictions| Jurisdiction | Law | How it reaches this requirement |
|---|---|---|
 European Union |
Commission Implementing Regulation (EU) 2025/2392, Technical Description of Important and Critical Products with Digital Elements |
Through its DPIA duty. What it requires |
 Finland |
Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems |
Through its DPIA duty. What it requires |
Sector security regimes
2 laws, 2 jurisdictions| Jurisdiction | Law | How it reaches this requirement |
|---|---|---|
 Montenegro |
Law on Information Security, Essential and Important Entities |
Through its DPIA duty. What it requires |
 New York |
DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation |
Through its DPIA duty. What it requires |
Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.