NIS2 control library
Every control CMDash tracks for NIS2, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history.
23 controls3 families18 mapped to other frameworksNo published text extract yet
Families
Governance · 2
| Art.20(1) | Management body approves and oversees the risk-management measures Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.20(2) | Cybersecurity training for the management body and staff Maps to ISO/IEC 27001:2022 |
Cybersecurity Risk-Management Measures · 13
| Art.21(1) | Appropriate and proportionate risk-management measures Maps to NIST Cybersecurity Framework 2.0 |
| Art.21(2)(a) | Policies on risk analysis and information system security Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(b) | Incident handling Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(c) | Business continuity, backup management, disaster recovery and crisis management Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(d) | Supply chain security Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(f) | Assessing the effectiveness of risk-management measures Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(g) | Basic cyber hygiene practices and cybersecurity training Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(h) | Cryptography and encryption Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(i) | Human resources security, access control and asset management Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(2)(j) | Multi-factor or continuous authentication and secured communications Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(3) | Supplier-specific vulnerabilities and product quality Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.21(4) | Corrective measures without undue delay |
Reporting Obligations · 8
| Art.23(1) | Notifying significant incidents to the CSIRT or competent authority Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.23(2) | Informing recipients of significant cyber threats Maps to NIST Cybersecurity Framework 2.0 |
| Art.23(3) | Criteria for a significant incident Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.23(4)(a) | Early warning within 24 hours |
| Art.23(4)(b) | Incident notification within 72 hours |
| Art.23(4)(c) | Intermediate report on request |
| Art.23(4)(d) | Final report within one month Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| Art.23(4)(e) | Progress report for an incident still ongoing |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for NIS2 2022/2555, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.