Jeden NIS2 control pokrýva GDPR, DORA aj ISO 27001

Controller accountability + technical/organisational measures overlap with management oversight; GDPR does not require personal board training.

ICT risk management framework with explicit management body accountability — near-identical to NIS2 Art. 20.

Policies, roles, responsibilities, management commitment — covers governance with similar rigor.

Control Environment (governance, board oversight) + Communication — similar to NIS2 Art. 20 management responsibility.

Govern function — Organizational Context + Roles, Responsibilities & Authorities. CSF 2.0 Govern was added in 2024.

CIS Controls v8 are technical-first — governance / management-body accountability is implied via IG selection but not an explicit control.

Security Official designation (Assigned Security Responsibility) — narrower than NIS2 management-body accountability; no board-training mandate.

Requirement 12.1 — security policy governance + 12.4 executive management accountability. Scope limited to cardholder data environment (CDE).

Risk-based security + DPIA for high-risk processing; scope narrower (personal data only).

Full ICT risk management framework, classification, monitoring, response — equivalent + deeper for FS.

Threat intelligence + risk assessment process in Clause 6.1 = direct NIS2 equivalent.

Risk Assessment objectives + risk identification + fraud risk + significant change assessment — strongly aligned with NIS2 Art. 21.

Identify — Risk Assessment + Govern — Risk Management Strategy. Direct equivalent of NIS2 Art. 21(1)-(2).

Inventory of Enterprise Assets + Software Assets + Data Recovery — CIS v8 is control-driven; no dedicated risk-assessment process but covers risk-reducing controls.

Risk Analysis + Risk Management (Administrative Safeguards) — mandatory, documented, periodically reviewed. Scope limited to ePHI.

Requirement 12.3 — risk assessment methodology to identify threats to CDE, at least annually + upon significant change.

72h data-breach notification to DPA + data-subject notification; narrower trigger (personal data breach).

4h major ICT incident classification + initial, intermediate, final reports — deeper and faster than NIS2.

Incident management lifecycle + lessons learned + evidence collection = aligned with NIS2 Art. 23.

Incident detection + response + recovery + root-cause analysis aligned with NIS2 Art. 23 notification chain.

Detect + Respond functions — full lifecycle from anomaly detection through response coordination. Close match to NIS2 Art. 23.

Incident Response Management — 9 safeguards covering plan, designation, reporting, lessons-learned. No regulator-notification requirement but operational alignment is strong.

Security Incident Procedures + Breach Notification Rule — 60-day notification to affected individuals + HHS (vs NIS2's 24h early warning + 72h update).

Requirement 12.10 — Incident Response Plan with testing, notifying card brands and acquirers upon suspected/confirmed card data breach.

Ability to restore availability/access to personal data in a timely manner — narrower than full BCP/DRP.

Business continuity policy + DR + scenario testing + response/recovery plans — fully aligned.

ICT readiness for business continuity + redundancy of processing facilities — direct equivalent.

Availability criteria — capacity planning, environmental protection, backup & recovery. Criterion A is an opt-in in SOC 2.

Recover function — Recovery Planning + Communications + Response/Recovery plan within Protect category.

Data Recovery — backups, isolated recovery, testing. Focused on data continuity; BCP process narrower than NIS2 full BC/DR scope.

Contingency Plan — Data Backup + Disaster Recovery Plan + Emergency Mode Operation + Testing & Revision + Applications & Data Criticality Analysis.

Requirement 9.4.1 — offline media backups + 12.10.1 data recovery procedures. PCI does not cover full BCP/DR for non-CDE operations.

Processor due diligence + Art. 28 DPA + transfer safeguards — overlaps for data-processing vendors only.

Third-party ICT risk framework + Register of Information + contractual clauses — deeper than NIS2.

Supplier relationships, addressing security in agreements, monitoring supplier services.

Vendor management — due diligence, monitoring, contract reviews. Narrower than NIS2 but aligned in intent.

Govern — Supply Chain Risk Mgmt + Identify — Supply Chain. New GV.SC category in CSF 2.0 is a direct NIS2 Art. 21(2)(d) equivalent.

Service Provider Management — inventory, classification, contractual security requirements, monitoring. Directly aligned with NIS2 Art. 21(2)(d).

Business Associate Contracts + written assurances — required BAAs for ePHI handlers. Narrower than NIS2 but same structural intent.

Requirement 12.8 — TPSP management (due diligence, written agreements, compliance monitoring) + 12.9 TPSP acknowledges responsibility. Directly aligned.

Confidentiality + access control for personal data; no explicit MFA / PAM requirement.

Strong authentication + PAM + logical and physical access controls.

Access control policy + privileged rights + authentication + secure logon — full overlap with NIS2 MFA/PAM.

Logical and physical access controls + user authentication + authorization management. Near-identical requirement.

Protect — Identity Management, Authentication and Access Control (PR.AA-01 through PR.AA-06) — direct equivalent of NIS2 MFA/PAM.

Account Management + Access Control Management — MFA for admin + remote + external (Safeguards 6.3-6.5), privileged accounts (5.4), role-based access (6.8).

Workforce Security + Information Access Management + Access Control + Audit Controls + Integrity + Person or Entity Authentication — full AAA coverage for ePHI.

Requirement 7 — restrict access by business need-to-know + Requirement 8 — unique ID + MFA for all non-console admin + remote access (8.4/8.5). Tightest MFA requirements of any framework.

Pseudonymisation + encryption as example measure; not mandatory minimum standard.

Cryptographic controls and key management referenced in ICT security policy.

Use of cryptography — full equivalent, identical expectation of key management.

Encryption of data in transit and at rest. Criterion C (Confidentiality) is opt-in — selected by most SaaS vendors.

Protect — Data-in-rest and Data-in-transit protected. Cryptographic controls explicitly aligned with NIS2 Art. 21(2)(h).

Data Protection — data classification, encryption at rest (Safeguard 3.11), in transit (3.10). No explicit key-management process; relies on IG2/IG3 scope.

Encryption & Decryption (addressable) for ePHI at rest + transmission security. Addressable = document alternative if not implemented.

Requirement 3 — protect stored account data (strong cryptography + key management lifecycle) + Requirement 4 — strong cryptography for transmission. Prescriptive key-management.

DPO awareness training obligation only; GDPR does not mandate board training.

ICT security awareness programmes, including for management body.

Awareness, education, training — mandatory for all roles incl. top management.

Commitment to competence + internal communication on security objectives. Does not mandate board-level training explicitly.

Protect — Awareness and Training (PR.AT-01, -02). Covers workforce + privileged users + all relevant roles including management.

Security Awareness & Skills Training — 9 safeguards covering social engineering, data handling, authentication, causes of incidents + role-specific training.

Security Awareness & Training — periodic updates, security reminders, malware protection, login monitoring, password management. Covers all workforce but not board-specific.

Requirement 12.6 — security awareness program at hire + annually, multiple methods, acknowledgement. Does not mandate board-level training.

Confidentiality obligation of persons acting under authority of controller/processor.

HR policies for ICT staff + segregation of duties.

Screening + terms of employment + disciplinary process + termination — full HR security lifecycle.

Screening + authorization management + termination workflows. Less prescriptive than NIS2 on HR personnel security.

Personnel security overlaps with Identity Management (onboarding/offboarding) and Roles & Responsibilities.

Account lifecycle management (onboarding/offboarding/dormant accounts). No screening, terms-of-employment or disciplinary process in CIS v8.

Workforce Clearance Procedure + Access Authorization / Establishment / Modification + Termination Procedures — directly governs HR security lifecycle for ePHI access.

Requirement 12.7 — personnel screening before hire (background checks) for positions with access to CDE. Narrower than NIS2 full HR security lifecycle.

Record of Processing Activities (RoPA) — overlaps for assets processing personal data only.

Identification, classification and documentation of ICT assets + dependencies — identical requirement.

Inventory of information + classification + labelling + acceptable use — full asset management overlap.

Asset identification + protection + disposal of system assets and data. Less granular on inventory than NIS2.

Identify — Asset Management (ID.AM-01 through ID.AM-08). Inventory of hardware, software, data, services — direct equivalent.

Enterprise Assets + Software Assets + Data inventory. CIS Controls v8 anchors on asset inventory (Controls 1-3) — the strongest overlap in the entire framework.

Device and Media Controls — disposal, reuse, accountability, data backup/storage. Narrower than NIS2 — asset inventory is implied but not prescribed.

Requirement 9.5 — media inventory + 12.5.1 maintained inventory of system components in CDE. CDE-scoped inventory only.