Antonio Tejeda Encinas CEO META Channel corp. President of the Euro-American Committee on Digital Law –EA Digital Law.
Let’s not trust!
Parallelism and Complementarity between NIS2, ISO/IEC 27001 and NIST CSF 2.0: A Comprehensive Framework for Cybersecurity in Europe
With the growing importance of cybersecurity in Europe, it is essential to understand the differences and complementarities between these three frameworks:
NIS2 (European Network and Information Systems Security Directive)
– Nature: European Union legal and regulatory directive.
– Objective: Ensure a minimum level of cybersecurity in critical infrastructure and essential sectors (energy, health, transport, etc.).
– Mandatory: Mandatory compliance for all member states and companies in critical sectors.
– Scope: Protection of the security of essential infrastructure and digital services.
– Applicable: From October 2024.
ISO/IEC 27001 (Information Security Management System)
– Nature: International VOLUNTARY Standard.
– Objective: Create a security management system that ensures the confidentiality, integrity and availability of information.
– Mandatory: Volunteer, based on certification.
– Scope: Applicable to any type of organization that wants to structure its security according to its specific risks.
– Applicable Last updated October 2022.
NIST CSF 2.0 (National Institute of Standards and Technology Cybersecurity Framework)
– Nature: Cybersecurity management framework developed in the US
– Objective: Provide good practices to manage risks and improve safety posture in organizations.
– Mandatory: Volunteer, adopted by many companies as reference standard.
– Coverage: Adaptable approach for all types of organizations, from small businesses to large corporations.
– Applicable: Draft version 2.0 presented in October 2024.
Why is it important? 🔍👇
Although they all address cybersecurity, NIS2 establishes a mandatory legal framework to protect critical infrastructures in Europe. While ISO 27001 and NIST CSF 2.0 are voluntary guides that allow companies to structure their security according to their own risks and objectives.
Together, these frameworks are not replaced, but complement each other to build a comprehensive cybersecurity environment in the region.
