[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002Foverview":3},{"item":4,"lessons":16,"controls":38,"related":65},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","overview","NIS2","NIS2 Directive (Directive (EU) 2022\u002F2555)",5,"European Union","**What it asks for.** NIS2 is the EU directive on measures for a high common level of cybersecurity across the Union. It widens the scope of the original NIS Directive to many more sectors, classifies organisations as essential or important entities, and sets duties for risk management, incident reporting, management accountability and supervision. Member States had to transpose it by October 2024.\n\n**In practice.** Organisations should first confirm whether and where they are in scope under national transposition laws, register with the competent authority where required, and map Article 21 measures to their control framework. Management must approve and oversee measures, and incident reporting processes must meet Article 23 timelines. Evidence includes scope analysis, risk management documentation, board approvals and reporting procedures.\n\n**Common gaps.** Many organisations misjudge their scope, particularly groups operating across several Member States with differing national laws. Management body training and accountability are often treated as formalities.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"eu-uk-sanction-russias-turla-group-for-state-sponsored-cyberespionage","EU & UK Sanction Russia's Turla Group for State-Sponsored Cyberespionage","2026-07-13T18:21:18.5+00:00",{"slug":23,"title":24,"published_at":25},"critical-infrastructure-data-breach-exposes-300k-customer-records","Critical Infrastructure Data Breach Exposes 300K Customer Records","2026-06-06T02:20:15.861+00:00",{"slug":27,"title":28,"published_at":29},"critical-infrastructure-data-breach-exposes-spanish-wind-energy-sector","Critical Infrastructure Data Breach Exposes Spanish Wind Energy Sector","2026-04-14T17:09:53.952+00:00",{"slug":31,"title":32,"published_at":33},"french-national-id-agency-suffers-massive-data-breach-exposing-18m-citizens","French National ID Agency Suffers Massive Data Breach Exposing 18M Citizens","2026-04-14T17:08:58.056+00:00",{"slug":35,"title":36,"published_at":37},"critical-infrastructure-faces-advanced-persistent-threats-through-identity-compromise","Critical Infrastructure Faces Advanced Persistent Threats Through Identity Compromise","2026-03-31T20:08:09.447+00:00",[39,44,49,53,57,61],{"slug":40,"name":41,"problem":42,"stories":43},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",3,{"slug":45,"name":46,"problem":47,"stories":48},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":50,"name":51,"problem":52,"stories":48},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":54,"name":55,"problem":56,"stories":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60,"stories":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64,"stories":48},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[66,71,76,81,85,90,95,99],{"family":67,"item":68,"code":69,"title":70,"together":43},"gdpr","32","Article 32","Security of processing",{"family":72,"item":73,"code":74,"title":75,"together":43},"nist-csf","pr-ds","PR.DS-1","Data Security",{"family":77,"item":78,"code":79,"title":80,"together":43},"cis","13","Control 13","Network Monitoring and Defense",{"family":77,"item":82,"code":83,"title":84,"together":43},"3","Control 3","Data Protection",{"family":77,"item":86,"code":87,"title":88,"together":89},"12","Control 12","Network Infrastructure Management",2,{"family":91,"item":92,"code":93,"title":94,"together":89},"nist-800-53","ac-2","AC-2","Account Management",{"family":96,"item":6,"code":97,"title":98,"together":89},"iec-62443","62443","IEC 62443 series",{"family":67,"item":100,"code":101,"title":102,"together":48},"25","Article 25","Data protection by design and by default"]