Law / Frameworks / Crosswalk / ENISA NIS2 guidance to NIST Privacy Framework
The ENISA NIS2 Technical Implementation Guidance, mapped to the NIST Privacy Framework
19 of ENISA NIS2 guidance's requirements connect to 12 of NIST Privacy Framework's through 176 laws in 91 jurisdictions. Two requirements connect when the same duties, in at least 2 laws we track, reach both. The connections are our own reading of the law; no framework publisher has reviewed or endorsed them.
- From
- ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, European Union Agency for Cybersecurity (ENISA)
- To
- NIST Privacy Framework, version 1.0, January 2020, National Institute of Standards and Technology
- See also
- NIST Privacy Framework to ENISA NIS2 guidance, the other way · every pair in the crosswalk · law library as of
Download this mapping, with every law behind each connection: nist-privacy-framework--enisa-nis2-guidance.csv · nist-privacy-framework--enisa-nis2-guidance.json
Not connected to the NIST Privacy Framework: 30 of ENISA NIS2 guidance's requirements
Short of 2 laws
The same duties reach these and a NIST Privacy Framework control, in fewer than 2 of the laws we track.
- 5.1 Supply chain security policy: with CM.AW-P7 through Information and Communications Act, 2009, security of information and communications services (subscriber risk notification), Gambia
No NIST Privacy Framework control on the same duties
Laws reach these, but no duty that reaches one of them also reaches a NIST Privacy Framework control.
- 2.3 Independent review of information and network security, 4 laws
No law we track reaches these
No duty in the laws we track reaches these requirements.
- 3.3 Event reporting
- 5.2 Directory of suppliers and service providers
- 6.1 Security in acquisition of ICT services or ICT products
- 6.3 Configuration management
- 6.4 Change management, repairs and maintenance
- 6.6 Security patch management
- 6.7 Network security
- 6.8 Network segmentation
- 6.9 Protection against malicious and unauthorised software
- 7.1 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
- 8.1 Awareness raising and basic cyber hygiene practices
- 8.2 Security training
- 10.1 Human resources security
- 10.2 Verification of background
- 10.3 Termination or change of employment procedures
- 10.4 Disciplinary process
- 11.1 Access control policy
- 11.3 Privileged accounts and system administration accounts
- 11.4 Administration systems
- 11.5 Identification
- 11.6 Authentication
- 11.7 Multi-factor authentication
- 12.1 Asset classification
- 12.3 Removable media policy
- 12.5 Deposit, return or deletion of assets upon termination of employment
- 13.1 Supporting utilities
- 13.2 Protection against physical and environmental threats
- 13.3 Perimeter and physical access control
How these connections are drawn
Each requirement line in the laws we track is read against the framework for its subject (the AI, scraping and news aggregation laws against the NIST AI RMF, the privacy, communications and age assurance laws against the NIST Privacy Framework, the cybersecurity laws against the NIST CSF 2.0); laws on liability and content moderation are not read against any framework yet. A line reaches the ENISA NIS2 guidance through a kind of duty its law carries, and only where that kind of duty also reaches, on that same line, the NIST framework for the line's own subject. Two requirements connect when lines in at least 2 laws reach both. That says the same duties reach both; it does not say the two are alike, or that running either one does what a law asks.
A line placed on a control in the framework for its own subject, whose law carries a kind of duty that reaches another of the three frameworks read line by line, is read against that one as well: every such line, or only those whose wording reaches into it. For these two:
| Laws on | Read against the NIST Privacy Framework |
|---|---|
| cybersecurity | every such line |
Every duty line in the cybersecurity laws we track has been read against the framework for its subject.
Sources and licenses
ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced.