EECC Art. 40 vs NIS2 Art. 21: The 7 Security Gaps Telecom Operators Must Close Before Enforcement
EECC-compliant telecoms still face 7 NIS2 Art. 21 gaps. See which EECC controls carry forward and what to build before your first ex-ante audit.
-
-
Financial Entities DORA Excludes Still Face NIS2: Article 2(3)’s 6 Categories Mapped to a Sector-Specific Checklist
Six financial entity types DORA excludes still face NIS2 Article 21. This checklist maps each to its obligations, evidence needs, and penalty exposure.
-
NIS2 Manufacturing Compliance: The 10-Measure Roadmap for Annex II Entities
Manufacturing in NIS2 Annex II? The 10 Article 21 measures mapped to OT reality — plus the board liability clause most compliance teams miss.
-
NIS2 Digital Infrastructure: CIR 2024/2690 Adds 150+ Binding Controls for DNS, TLD, and CDN Operators
CIR 2024/2690 imposes 150+ binding controls on DNS, TLD, CDN, and data centre operators under NIS2. IXPs face Article 21 only. Full compliance matrix and June 2026 audit deadline inside.
-
What CIR 2024/2690 Annex Section 13 Requires for Data Centre Physical Security — and the 1-Hour Rule That Triggers Incident Reports
Most auditors check your Section 13 Physical & Environmental Security Policy first. Learn what CIR 2024/2690 actually requires — perimeter layers, CCTV retention, UPS testing, and the cooling failure that becomes a 72-hour incident report.
-
How Space Sector Operators Satisfy CIR Annex 5 Supply Chain Audits: Launch Vehicles, Satellite Firmware SBOMs, and COTS Risk
CIR Title 5 supply chain audits for space operators: how to structure satellite firmware SBOMs, navigate ITAR/EAR audit right restrictions, and document COTS procurement risk before your first NIS2 inspection.
-
Why NIS2 CIR Annex §6.7 Requires RPKI for IXPs — and How Route Leaks Trigger Art.23 Reporting
CIR Annex §6.7 is the operative NIS2 provision for IXP BGP security — not §6.4. Learn how route leaks and BGP hijacks trigger Art.23 differently, and how MANRS closes the compliance gap.
-
Telecom Supply Chain Security Under NIS2 Article 21(2)(d): 5G Toolbox High-Risk Vendor Restrictions, RAN Diversity, and Contractual Obligations
How EU 5G Toolbox high-risk vendor designations create specific NIS2 Article 21(2)(d) obligations for telecom operators — covering RAN, core network, OSS/BSS supplier tiers, contractual clauses, and the CSA2 phase-out timeline.
-
Government Shared Services Under NIS2: Why NHS-Style IT Suppliers Create Article 21(2)(d) Risks Most Entities Miss
Government shared IT services are NIS2 Article 21(2)(d) direct suppliers — most compliance programmes haven’t assessed them. This guide fills the gap.
-
NIS2 Art. 23 for Public Administration: GovCERT vs. CSIRT Routing, the Art. 2(7) Exclusion, and What Central Government Must Report
Does NIS2 apply to your public body? Art. 2(7) exclusion, GovCERT vs. CSIRT routing in DE, AT, and NL, and what your Art. 23 notification must contain.
