In response to ENISA’s open consultation process, The European Cybersecurity Organisation (ECSO) is providing feedback to enhance the Technical Guidance on NIS2 Implementation. The Technical Guidance represents a significant step forward in providing actionable recommendations for companies within the directive’s scope

ECSO’s Members recommend modifications to enhance effectiveness of the Technical Guidance and align with current security best practices. The introduction should be refined to better reflect the principles of proportionality, appropriateness, and feasibility.

The security framework would benefit from a more detailed enumeration of risk analysis and security objectives throughout its chapters. While the roles and responsibilities section is thorough, it could be strengthened by including practical organizational charts that demonstrate duty segregation, with the positive inclusion of ECSF references for role definition.

The risk management component needs expansion to address gross risk assessment, existing security measures’ impact, residual risk evaluation, risk appetite considerations, and resource allocation mechanisms, along with specific risk metrics.

The incident handling procedures require clearer distinction between security events and incidents, including severity level classifications and corresponding response protocols. For modern infrastructure considerations, the backup management strategy should incorporate cloud-specific provisions, including cross-zone replication and encryption protocols.

Additional recommendations include requiring CSIRT contact point certifications, developing comprehensive supply chain risk mitigation strategies, leveraging the Cyber Skills Academy resources, integrating cybersecurity frameworks and maturity models into human resources security, and implementing device attestation for enhanced access control measures.