The regimes differ in wording. One intelligence workflow produces the evidence each of them asks for.
Aligned to the core functions (Govern, Identify, Protect, Detect, Respond and Recover) with continuous threat monitoring and intelligence-driven risk assessment supporting Govern, Identify and Detect.
Operationalises the continuous-monitoring, risk-management and incident-documentation duties NIS 2 introduces. Dated requirements and tagged dissemination logs evidence risk-based prioritisation, supply-chain oversight and timely incident reporting (Arts 21, 23–24).
Data minimisation in collection, clear consent mechanisms, data portability support and the right to erasure. The privacy policy details how personal data is processed and protected.
Information security management aligned to the standard: formal risk assessment, access control policies, incident response procedures and continuous monitoring of security posture.
Supports all five pillars: evidence for ICT risk management, enriched reports for major-incident reporting, real-world TTPs to shape resilience testing, and threat monitoring to inform third-party risk.
One workflow is the proof for all five: dated requirements show what you prioritised, consolidated reports show how you analysed it, and dissemination tagging shows who you told and when: the timestamped, traceable trail regulators ask for.
