bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/nis2/article-21-measures.md

@@ -1,153 +1,153 @@
-# NIS2 Article 21 — Cybersecurity Risk Management Measures
-
-Directive (EU) 2022/2555, Art. 21 requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures" to manage risks and protect network and information systems. Proportionality is assessed against the entity's size, exposure, and the severity of potential impact.
-
----
-
-## Measure 1 — Risk Analysis & Information Security Policies
-
-**Requirement:** Documented policies covering risk analysis methodology and information security governance.
-
-**Implementation guidance:**
-- Adopt a formal risk management methodology (ISO 27005, NIST RMF, or equivalent)
-- Produce and maintain an asset inventory covering in-scope network and information systems
-- Define risk acceptance criteria aligned to business impact
-- Review risk assessments at least annually and after significant incidents or changes
-- Ensure the management body approves the risk management policy (Art. 20 link)
-
----
-
-## Measure 2 — Incident Handling
-
-**Requirement:** Procedures for detection, analysis, containment, eradication, and recovery.
-
-**Implementation guidance:**
-- Maintain a written Incident Response Plan (IRP) covering all NIS2 significant incident scenarios
-- Define "significant incident" thresholds in line with Art. 23(3): substantial disruption to service delivery, financial loss to the entity, or material/non-material damage to other natural or legal persons
-- Establish 24h/72h/1-month reporting workflows with pre-drafted notification templates for the national CSIRT or competent authority
-- Conduct post-incident reviews; feed lessons learned back into risk assessment
-- Test IRP at least annually via tabletop exercises or simulations
-
-**Significant incident indicators (Art. 23(3)):**
-- Service disruption affecting a significant number of users
-- Duration > a few hours for critical services
-- Geographic spread affecting other Member States
-- Reputational, financial, or safety impact
-
----
-
-## Measure 3 — Business Continuity, Backup & Disaster Recovery
-
-**Requirement:** Plans for service continuity, backup management, disaster recovery (DR), and crisis management during and after incidents.
-
-**Implementation guidance:**
-- Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) per critical service
-- Implement automated, encrypted, offsite backups; test restoration quarterly
-- Maintain DR runbooks and infrastructure failover playbooks
-- Define a crisis management structure with clear roles, decision authorities, and escalation paths
-- Test BCP/DR at least annually; involve management body in crisis management exercises
-
----
-
-## Measure 4 — Supply Chain Security
-
-**Requirement:** Address security in supply chain relationships, including between entities and their direct suppliers and service providers.
-
-**Implementation guidance:**
-- Maintain a register of critical ICT suppliers and third-party service providers
-- Perform pre-onboarding security assessments (questionnaires, certifications, audits)
-- Include NIS2/security requirements as contractual obligations (right-to-audit, incident notification SLAs, minimum security baselines)
-- Assess supply chain risks as part of the annual risk assessment
-- Monitor ENISA and national authority supply chain risk assessments (Art. 26 coordinated risk assessments)
-- Apply enhanced due diligence to high-risk ICT vendors identified by Member States
-
----
-
-## Measure 5 — Secure Acquisition, Development & Maintenance
-
-**Requirement:** Security in the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure.
-
-**Implementation guidance:**
-- Apply Secure SDLC practices: threat modelling, code review, SAST/DAST, penetration testing
-- Establish a vulnerability management programme with defined SLAs for patching by severity (e.g., critical ≤ 7 days, high ≤ 30 days)
-- Maintain a coordinated vulnerability disclosure (CVD) policy (aligned with ENISA CVD guidelines)
-- Track CVEs relevant to in-scope systems using threat intelligence feeds
-- Include security acceptance criteria in vendor contracts for purchased systems
-
----
-
-## Measure 6 — Effectiveness Assessment
-
-**Requirement:** Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
-
-**Implementation guidance:**
-- Define KPIs/KRIs for each Art. 21 measure (e.g., mean time to detect, patch compliance rate, training completion rate)
-- Conduct internal audits or management reviews at least annually
-- Engage independent third-party assessors or penetration testers as appropriate
-- Report effectiveness metrics to the management body
-- Map findings to the risk register and trigger remediation plans
-
----
-
-## Measure 7 — Cyber Hygiene & Training
-
-**Requirement:** Basic cyber hygiene practices and cybersecurity training for staff.
-
-**Implementation guidance:**
-- Deploy mandatory security awareness training for all staff at least annually
-- Cover: phishing, social engineering, password hygiene, incident reporting, BYOD/remote working
-- Provide role-based training for IT/OT administrators, incident responders, and the management body
-- Management body must complete cybersecurity training specific to Art. 20 governance obligations
-- Track completion rates; address gaps before audit cycles
-
----
-
-## Measure 8 — Cryptography & Encryption
-
-**Requirement:** Policies and procedures on the use of cryptography and, where appropriate, encryption.
-
-**Implementation guidance:**
-- Define approved cryptographic algorithms (AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256/SHA-384 for hashing)
-- Establish a key management lifecycle: generation, storage (HSM recommended for critical keys), rotation, and destruction
-- Require encryption of sensitive data stored in cloud environments and on portable media
-- Review cryptographic standards annually given evolving threats (e.g., post-quantum readiness)
-- Document exceptions and compensating controls where encryption is not feasible
-
----
-
-## Measure 9 — Human Resources Security, Access Control & Asset Management
-
-**Requirement:** HR security, access control policies and asset management.
-
-**Implementation guidance:**
-- Apply least-privilege and need-to-know principles for system access
-- Implement role-based access control (RBAC); review permissions quarterly
-- Conduct background screening for roles with privileged access (subject to applicable employment law)
-- Maintain an authoritative asset inventory (hardware, software, data assets)
-- Enforce joiners/movers/leavers process with same-day revocation for leavers
-- Apply identity lifecycle management; disable dormant accounts after 30–90 days inactivity
-
----
-
-## Measure 10 — MFA, Secure Communications & Emergency Systems
-
-**Requirement:** Use of multi-factor authentication (MFA) or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems.
-
-**Implementation guidance:**
-- Require MFA for all remote access, privileged accounts, and cloud management consoles
-- Apply phishing-resistant MFA (FIDO2/hardware tokens) for highest-privilege accounts
-- Enforce MFA for email access, VPN, and SaaS platforms holding sensitive data
-- Use end-to-end encrypted channels for sensitive internal communications (e.g., incident coordination)
-- Maintain a separate, documented emergency communication plan with out-of-band channels in case primary systems are compromised
-
----
-
-## Proportionality Principle
-
-Art. 21(1) requires measures to be "appropriate and proportionate" taking into account:
-- The entity's exposure to risks
-- The entity's size
-- The likelihood and severity of incidents including societal and economic impact
-- The cost of implementation
-
-Essential Entities face more rigorous supervisory scrutiny (Art. 32 proactive) and should apply controls at the higher end of the proportionality spectrum. Important Entities are subject to reactive supervision (Art. 33) but face the same 10-measure obligations.
+# NIS2 Article 21 — Cybersecurity Risk Management Measures
+
+Directive (EU) 2022/2555, Art. 21 requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures" to manage risks and protect network and information systems. Proportionality is assessed against the entity's size, exposure, and the severity of potential impact.
+
+---
+
+## Measure 1 — Risk Analysis & Information Security Policies
+
+**Requirement:** Documented policies covering risk analysis methodology and information security governance.
+
+**Implementation guidance:**
+- Adopt a formal risk management methodology (ISO 27005, NIST RMF, or equivalent)
+- Produce and maintain an asset inventory covering in-scope network and information systems
+- Define risk acceptance criteria aligned to business impact
+- Review risk assessments at least annually and after significant incidents or changes
+- Ensure the management body approves the risk management policy (Art. 20 link)
+
+---
+
+## Measure 2 — Incident Handling
+
+**Requirement:** Procedures for detection, analysis, containment, eradication, and recovery.
+
+**Implementation guidance:**
+- Maintain a written Incident Response Plan (IRP) covering all NIS2 significant incident scenarios
+- Define "significant incident" thresholds in line with Art. 23(3): substantial disruption to service delivery, financial loss to the entity, or material/non-material damage to other natural or legal persons
+- Establish 24h/72h/1-month reporting workflows with pre-drafted notification templates for the national CSIRT or competent authority
+- Conduct post-incident reviews; feed lessons learned back into risk assessment
+- Test IRP at least annually via tabletop exercises or simulations
+
+**Significant incident indicators (Art. 23(3)):**
+- Service disruption affecting a significant number of users
+- Duration > a few hours for critical services
+- Geographic spread affecting other Member States
+- Reputational, financial, or safety impact
+
+---
+
+## Measure 3 — Business Continuity, Backup & Disaster Recovery
+
+**Requirement:** Plans for service continuity, backup management, disaster recovery (DR), and crisis management during and after incidents.
+
+**Implementation guidance:**
+- Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO) per critical service
+- Implement automated, encrypted, offsite backups; test restoration quarterly
+- Maintain DR runbooks and infrastructure failover playbooks
+- Define a crisis management structure with clear roles, decision authorities, and escalation paths
+- Test BCP/DR at least annually; involve management body in crisis management exercises
+
+---
+
+## Measure 4 — Supply Chain Security
+
+**Requirement:** Address security in supply chain relationships, including between entities and their direct suppliers and service providers.
+
+**Implementation guidance:**
+- Maintain a register of critical ICT suppliers and third-party service providers
+- Perform pre-onboarding security assessments (questionnaires, certifications, audits)
+- Include NIS2/security requirements as contractual obligations (right-to-audit, incident notification SLAs, minimum security baselines)
+- Assess supply chain risks as part of the annual risk assessment
+- Monitor ENISA and national authority supply chain risk assessments (Art. 26 coordinated risk assessments)
+- Apply enhanced due diligence to high-risk ICT vendors identified by Member States
+
+---
+
+## Measure 5 — Secure Acquisition, Development & Maintenance
+
+**Requirement:** Security in the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure.
+
+**Implementation guidance:**
+- Apply Secure SDLC practices: threat modelling, code review, SAST/DAST, penetration testing
+- Establish a vulnerability management programme with defined SLAs for patching by severity (e.g., critical ≤ 7 days, high ≤ 30 days)
+- Maintain a coordinated vulnerability disclosure (CVD) policy (aligned with ENISA CVD guidelines)
+- Track CVEs relevant to in-scope systems using threat intelligence feeds
+- Include security acceptance criteria in vendor contracts for purchased systems
+
+---
+
+## Measure 6 — Effectiveness Assessment
+
+**Requirement:** Policies and procedures to assess the effectiveness of cybersecurity risk management measures.
+
+**Implementation guidance:**
+- Define KPIs/KRIs for each Art. 21 measure (e.g., mean time to detect, patch compliance rate, training completion rate)
+- Conduct internal audits or management reviews at least annually
+- Engage independent third-party assessors or penetration testers as appropriate
+- Report effectiveness metrics to the management body
+- Map findings to the risk register and trigger remediation plans
+
+---
+
+## Measure 7 — Cyber Hygiene & Training
+
+**Requirement:** Basic cyber hygiene practices and cybersecurity training for staff.
+
+**Implementation guidance:**
+- Deploy mandatory security awareness training for all staff at least annually
+- Cover: phishing, social engineering, password hygiene, incident reporting, BYOD/remote working
+- Provide role-based training for IT/OT administrators, incident responders, and the management body
+- Management body must complete cybersecurity training specific to Art. 20 governance obligations
+- Track completion rates; address gaps before audit cycles
+
+---
+
+## Measure 8 — Cryptography & Encryption
+
+**Requirement:** Policies and procedures on the use of cryptography and, where appropriate, encryption.
+
+**Implementation guidance:**
+- Define approved cryptographic algorithms (AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256/SHA-384 for hashing)
+- Establish a key management lifecycle: generation, storage (HSM recommended for critical keys), rotation, and destruction
+- Require encryption of sensitive data stored in cloud environments and on portable media
+- Review cryptographic standards annually given evolving threats (e.g., post-quantum readiness)
+- Document exceptions and compensating controls where encryption is not feasible
+
+---
+
+## Measure 9 — Human Resources Security, Access Control & Asset Management
+
+**Requirement:** HR security, access control policies and asset management.
+
+**Implementation guidance:**
+- Apply least-privilege and need-to-know principles for system access
+- Implement role-based access control (RBAC); review permissions quarterly
+- Conduct background screening for roles with privileged access (subject to applicable employment law)
+- Maintain an authoritative asset inventory (hardware, software, data assets)
+- Enforce joiners/movers/leavers process with same-day revocation for leavers
+- Apply identity lifecycle management; disable dormant accounts after 30–90 days inactivity
+
+---
+
+## Measure 10 — MFA, Secure Communications & Emergency Systems
+
+**Requirement:** Use of multi-factor authentication (MFA) or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems.
+
+**Implementation guidance:**
+- Require MFA for all remote access, privileged accounts, and cloud management consoles
+- Apply phishing-resistant MFA (FIDO2/hardware tokens) for highest-privilege accounts
+- Enforce MFA for email access, VPN, and SaaS platforms holding sensitive data
+- Use end-to-end encrypted channels for sensitive internal communications (e.g., incident coordination)
+- Maintain a separate, documented emergency communication plan with out-of-band channels in case primary systems are compromised
+
+---
+
+## Proportionality Principle
+
+Art. 21(1) requires measures to be "appropriate and proportionate" taking into account:
+- The entity's exposure to risks
+- The entity's size
+- The likelihood and severity of incidents including societal and economic impact
+- The cost of implementation
+
+Essential Entities face more rigorous supervisory scrutiny (Art. 32 proactive) and should apply controls at the higher end of the proportionality spectrum. Important Entities are subject to reactive supervision (Art. 33) but face the same 10-measure obligations.

package/src/bmad-plus/packs/pack-shield/references/nis2/iso27001-nis2-mapping.md

@@ -1,68 +1,68 @@
-# ISO 27001:2022 to NIS2 Art. 21 Cross-Reference
-
-ISO/IEC 27001:2022 certification provides strong evidence of NIS2 compliance for many Art. 21 measures. However, ISO 27001 certification does NOT substitute NIS2 obligations — entities remain responsible for meeting Art. 21, Art. 20, and Art. 23 requirements directly.
-
-Key gaps where NIS2 goes beyond ISO 27001:
-- **Art. 21(2)(d)**: NIS2 explicitly mandates supply chain security obligations tied to ENISA coordinated risk assessments (Art. 26)
-- **Art. 21(2)(j)**: NIS2 explicitly mandates MFA — ISO 27001 Annex A.8.5 covers authentication but MFA is not universally required
-- **Art. 20**: Management body personal liability has no ISO 27001 equivalent
-- **Art. 23**: Incident reporting timelines (24h/72h/1 month) are more prescriptive than ISO 27001's general incident management controls
-
----
-
-## Mapping Table
-
-| NIS2 Art. 21 Measure | NIS2 Requirement | ISO 27001:2022 Annex A Controls |
-|---|---|---|
-| **M1** Risk Analysis & Policies | Risk analysis methodology, IS policies | A.5.1 Policies; A.6.1 IS roles; A.8.8 Vuln mgmt; Clause 6.1 Risk assessment; Clause 8.2 IS risk assessment |
-| **M2** Incident Handling | Detection, response, recovery procedures | A.5.24 IS incident planning; A.5.25 Assessment of IS events; A.5.26 Response; A.5.27 Post-incident review; A.5.28 Evidence collection |
-| **M3** BCP / DR / Crisis | Backup, DR, crisis management | A.5.29 IS during disruption; A.5.30 ICT readiness; A.8.13 Backup; A.8.14 Redundancy |
-| **M4** Supply Chain Security | Supplier/service-provider risk | A.5.19 IS in supplier relationships; A.5.20 Supplier agreements; A.5.21 ICT supply chain; A.5.22 Supplier monitoring; A.5.23 Cloud services |
-| **M5** Secure Acquisition & Dev | SDLC security, vulnerability disclosure | A.8.25 Secure dev lifecycle; A.8.26 App security; A.8.27 Secure architecture; A.8.28 Secure coding; A.8.29 Testing; A.8.30 Outsourced dev; A.5.8 IS in PM |
-| **M6** Effectiveness Assessment | KPIs, audits, management review | A.5.35 Independent IS review; A.5.36 Policy compliance; Clause 9.1 Monitoring; Clause 9.2 Internal audit; Clause 9.3 Management review |
-| **M7** Cyber Hygiene & Training | Awareness and training | A.6.3 IS awareness/training; A.5.7 Threat intelligence; A.6.8 IS event reporting |
-| **M8** Cryptography | Crypto policies, key management | A.8.24 Use of cryptography |
-| **M9** HR, Access Control, Asset Mgmt | Least privilege, RBAC, asset inventory | A.5.9 Asset inventory; A.5.10 Asset use; A.5.11 Asset return; A.8.2 Privileged access; A.8.3 Access restriction; A.8.4 Source code; A.6.1 Screening; A.6.5 Responsibilities on termination |
-| **M10** MFA & Secure Comms | MFA, phishing-resistant auth, encrypted comms | A.8.5 Secure authentication; A.8.20 Network security; A.8.26 App security; A.8.24 Cryptography |
-
----
-
-## ISO 27001 Controls With No Direct NIS2 Measure Equivalent
-
-The following ISO 27001:2022 Annex A controls are important for overall security posture but do not map to a specific Art. 21 measure. They may still be relevant for NIS2 governance and compliance evidence:
-
-- **A.5.2** IS roles and responsibilities
-- **A.5.31** Legal, statutory, regulatory, contractual requirements  
-- **A.5.32** Intellectual property rights
-- **A.5.33** Protection of records
-- **A.5.34** Privacy and PII protection (→ see also GDPR)
-- **A.6.4** Disciplinary process
-- **A.8.1** User endpoint devices
-- **A.8.9** Configuration management
-- **A.8.10** Information deletion
-
----
-
-## NIS2 Requirements With Limited ISO 27001 Coverage
-
-| NIS2 Requirement | Gap vs ISO 27001 | Recommended Action |
-|---|---|---|
-| Art. 20 — Management body approval and personal liability | No ISO 27001 equivalent | Board cybersecurity policy; training records; documented approval minutes |
-| Art. 23 — 24h early warning | ISO 27001 A.5.24–5.26 cover incident management but not specific timelines | Pre-drafted CSIRT notification templates; automated alerting workflows |
-| Art. 23 — 72h notification | Same as above | Incident triage runbooks with timeline checkpoints |
-| Art. 23 — 1-month final report | Same as above | Post-incident review template with all Art. 23(4) required fields |
-| Art. 26 — ENISA supply chain risk assessments | ISO 27001 A.5.19–5.23 cover supplier security generally | Monitor ENISA and national authority supply chain advisories; integrate into supplier risk register |
-| Art. 21(2)(j) — MFA mandate | ISO 27001 A.8.5 covers authentication; MFA not universal | Deploy MFA for remote access, privileged accounts, cloud consoles as minimum |
-
----
-
-## Practical Guidance for ISO 27001-Certified Entities
-
-If your organisation holds ISO 27001:2022 certification, you are well-positioned for NIS2 but should:
-
-1. **Confirm entity classification** — verify whether you are an EE or IE under Art. 3 and your Member State's transposition law
-2. **Address Art. 20 governance** — document board-level approval of cybersecurity measures and ensure training records are maintained
-3. **Implement the Art. 23 reporting workflow** — your IRP likely needs an explicit NIS2 notification track with pre-drafted CSIRT templates and 24h/72h/1-month checkpoints
-4. **Review supply chain coverage** — map your supplier security controls to Art. 21(2)(d) and integrate ENISA coordinated risk assessment outputs
-5. **Mandate MFA** — if not already universal, deploy MFA for remote access and privileged accounts
-6. **Register with your national competent authority** — most Member States require in-scope entities to self-register
+# ISO 27001:2022 to NIS2 Art. 21 Cross-Reference
+
+ISO/IEC 27001:2022 certification provides strong evidence of NIS2 compliance for many Art. 21 measures. However, ISO 27001 certification does NOT substitute NIS2 obligations — entities remain responsible for meeting Art. 21, Art. 20, and Art. 23 requirements directly.
+
+Key gaps where NIS2 goes beyond ISO 27001:
+- **Art. 21(2)(d)**: NIS2 explicitly mandates supply chain security obligations tied to ENISA coordinated risk assessments (Art. 26)
+- **Art. 21(2)(j)**: NIS2 explicitly mandates MFA — ISO 27001 Annex A.8.5 covers authentication but MFA is not universally required
+- **Art. 20**: Management body personal liability has no ISO 27001 equivalent
+- **Art. 23**: Incident reporting timelines (24h/72h/1 month) are more prescriptive than ISO 27001's general incident management controls
+
+---
+
+## Mapping Table
+
+| NIS2 Art. 21 Measure | NIS2 Requirement | ISO 27001:2022 Annex A Controls |
+|---|---|---|
+| **M1** Risk Analysis & Policies | Risk analysis methodology, IS policies | A.5.1 Policies; A.6.1 IS roles; A.8.8 Vuln mgmt; Clause 6.1 Risk assessment; Clause 8.2 IS risk assessment |
+| **M2** Incident Handling | Detection, response, recovery procedures | A.5.24 IS incident planning; A.5.25 Assessment of IS events; A.5.26 Response; A.5.27 Post-incident review; A.5.28 Evidence collection |
+| **M3** BCP / DR / Crisis | Backup, DR, crisis management | A.5.29 IS during disruption; A.5.30 ICT readiness; A.8.13 Backup; A.8.14 Redundancy |
+| **M4** Supply Chain Security | Supplier/service-provider risk | A.5.19 IS in supplier relationships; A.5.20 Supplier agreements; A.5.21 ICT supply chain; A.5.22 Supplier monitoring; A.5.23 Cloud services |
+| **M5** Secure Acquisition & Dev | SDLC security, vulnerability disclosure | A.8.25 Secure dev lifecycle; A.8.26 App security; A.8.27 Secure architecture; A.8.28 Secure coding; A.8.29 Testing; A.8.30 Outsourced dev; A.5.8 IS in PM |
+| **M6** Effectiveness Assessment | KPIs, audits, management review | A.5.35 Independent IS review; A.5.36 Policy compliance; Clause 9.1 Monitoring; Clause 9.2 Internal audit; Clause 9.3 Management review |
+| **M7** Cyber Hygiene & Training | Awareness and training | A.6.3 IS awareness/training; A.5.7 Threat intelligence; A.6.8 IS event reporting |
+| **M8** Cryptography | Crypto policies, key management | A.8.24 Use of cryptography |
+| **M9** HR, Access Control, Asset Mgmt | Least privilege, RBAC, asset inventory | A.5.9 Asset inventory; A.5.10 Asset use; A.5.11 Asset return; A.8.2 Privileged access; A.8.3 Access restriction; A.8.4 Source code; A.6.1 Screening; A.6.5 Responsibilities on termination |
+| **M10** MFA & Secure Comms | MFA, phishing-resistant auth, encrypted comms | A.8.5 Secure authentication; A.8.20 Network security; A.8.26 App security; A.8.24 Cryptography |
+
+---
+
+## ISO 27001 Controls With No Direct NIS2 Measure Equivalent
+
+The following ISO 27001:2022 Annex A controls are important for overall security posture but do not map to a specific Art. 21 measure. They may still be relevant for NIS2 governance and compliance evidence:
+
+- **A.5.2** IS roles and responsibilities
+- **A.5.31** Legal, statutory, regulatory, contractual requirements  
+- **A.5.32** Intellectual property rights
+- **A.5.33** Protection of records
+- **A.5.34** Privacy and PII protection (→ see also GDPR)
+- **A.6.4** Disciplinary process
+- **A.8.1** User endpoint devices
+- **A.8.9** Configuration management
+- **A.8.10** Information deletion
+
+---
+
+## NIS2 Requirements With Limited ISO 27001 Coverage
+
+| NIS2 Requirement | Gap vs ISO 27001 | Recommended Action |
+|---|---|---|
+| Art. 20 — Management body approval and personal liability | No ISO 27001 equivalent | Board cybersecurity policy; training records; documented approval minutes |
+| Art. 23 — 24h early warning | ISO 27001 A.5.24–5.26 cover incident management but not specific timelines | Pre-drafted CSIRT notification templates; automated alerting workflows |
+| Art. 23 — 72h notification | Same as above | Incident triage runbooks with timeline checkpoints |
+| Art. 23 — 1-month final report | Same as above | Post-incident review template with all Art. 23(4) required fields |
+| Art. 26 — ENISA supply chain risk assessments | ISO 27001 A.5.19–5.23 cover supplier security generally | Monitor ENISA and national authority supply chain advisories; integrate into supplier risk register |
+| Art. 21(2)(j) — MFA mandate | ISO 27001 A.8.5 covers authentication; MFA not universal | Deploy MFA for remote access, privileged accounts, cloud consoles as minimum |
+
+---
+
+## Practical Guidance for ISO 27001-Certified Entities
+
+If your organisation holds ISO 27001:2022 certification, you are well-positioned for NIS2 but should:
+
+1. **Confirm entity classification** — verify whether you are an EE or IE under Art. 3 and your Member State's transposition law
+2. **Address Art. 20 governance** — document board-level approval of cybersecurity measures and ensure training records are maintained
+3. **Implement the Art. 23 reporting workflow** — your IRP likely needs an explicit NIS2 notification track with pre-drafted CSIRT templates and 24h/72h/1-month checkpoints
+4. **Review supply chain coverage** — map your supplier security controls to Art. 21(2)(d) and integrate ENISA coordinated risk assessment outputs
+5. **Mandate MFA** — if not already universal, deploy MFA for remote access and privileged accounts
+6. **Register with your national competent authority** — most Member States require in-scope entities to self-register