NIST CSF 2.0
The common yardstick for coverage.
FRAMEWORKS · NIS2
NIS2 Directive: the obligations of entities.
Directive (EU) 2022/2555 requires essential and important entities in the EU to take cyber security risk management measures and to report incidents. Varmo includes the obligations of entities as a framework, split so that each obligation can be evidenced on its own.
Platform framework from the Pro plan
Scope
43 requirements from Art. 20 (governance), Art. 21 (cyber security risk management measures) and Art. 23 (reporting obligations). Points containing several obligations are split into sub-requirements.
- Wording and reference from the Official Journal of the EU
- Our own practical implementation guidance
- Mappings to NIST CSF 2.0
Directive and national law
NIS2 is a directive: entities are subject to the transposition law of the respective member state. For certain providers, such as cloud or managed services, Implementing Regulation (EU) 2024/2690 specifies the requirements; it is not part of the framework.
Relevance for Switzerland
Switzerland is not directly bound by NIS2. Swiss companies may still be affected if they operate in the EU or supply EU entities that have to secure their supply chain.
Together with ISO/IEC 27001
Many obligations under Art. 21 overlap in content with controls from ISO/IEC 27001. The coverage by CSF function shows where your existing implementation already applies and where gaps remain.
Related
Security incidents
Handle incidents and record the report.
Frequently asked questions
Is my organisation affected by NIS2?
That depends on sector, size and activity in the EU and is determined by the national transposition law. Varmo helps with implementation but does not replace a legal assessment of whether you are in scope.
FREE · ABOUT 5 MINUTES
How far along is your ISMS? Take the ISO 27001 self-assessment.
A traffic light per clause, your next steps and the right plan. No sign-up; your answers stay in your browser.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.