The compliance view: NIS2, ISO 27001, Cyber Essentials
How each finding relates to NIS2 Article 21(2), ISO/IEC 27001:2022 Annex A and Cyber Essentials, and what an outside view can and cannot tell.
Many teams monitor their domains because a framework asks them to. Perimetry Cloud relates each finding to the requirements of three frameworks, so you can see what an outside view says about each of them and prepare an assessment.
The three frameworks
- NIS2: the cybersecurity risk-management measures of Article 21(2) of the NIS2 Directive (EU) 2022/2555.
- Cyber Essentials: the five controls of the UK scheme’s requirements for IT infrastructure (v3.3).
- ISO 27001: the controls of Annex A of ISO/IEC 27001:2022 that an outside audit can relate to.
A finding is related to a requirement only when the link is direct.
Under each finding, on every plan
Every finding shows its related requirements, as small labels (for instance a NIS2 measure, a Cyber Essentials control, an ISO 27001 control). Hover a label to read the full name of the requirement.
The compliance view, from the Solo plan
On a report, Compliance view opens the view of that audit, one framework at a time (NIS2, Cyber Essentials, ISO 27001). For each requirement, it shows:
- the findings of this audit that relate to it, or
- Nothing found from the outside, or
- Not assessable from the outside, when an outside audit cannot see anything about it (your policies, your staff, your internal systems).
A line at the top counts the requirements with findings and those not assessable from the outside. Accepted findings are left out of the view, and it says how many.
The PDF report of the audit has the same mapping on its Compliance mapping page.
What it is, and what it is not
It is an indicative mapping, to help you prepare: an outside audit sees only part of what each requirement asks for. “Nothing found” never means “compliant”. It is not a certification and not legal advice.
For an assessor, three other features help:
- the risk register, for the findings you decided to accept, with their justification;
- attestations, dated PDFs of what the monitoring saw over a period, with the NIS2 Article 21(2) measures an outside view can speak to;
- the supplier watch, for the supply-chain requirement of NIS2 (Article 21(2)(d)).