Framework overlap

Does NIST Cybersecurity Framework 2.0 cover EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600)?

You hold NIST Cybersecurity Framework 2.0 and have been told to do EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600). Here is how much overlaps, control by control.

52% of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) you already have

NIST Cybersecurity Framework 2.0 already covers about 52% of EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600), leaving 12 of 25 controls as genuinely new work.

Already covered 4 Likely covered 9 New work 12

What is genuinely new work

Nothing in NIST Cybersecurity Framework 2.0 reaches these. This is the list to scope.

EIOPA-ICTSG-GL.1
Proportionality
EIOPA-ICTSG-GL.12
Information security reviews, assessment and testing
EIOPA-ICTSG-GL.13
Information security training and awareness
EIOPA-ICTSG-GL.16
ICT project management
EIOPA-ICTSG-GL.17
ICT systems acquisition and development
EIOPA-ICTSG-GL.18
ICT change management
EIOPA-ICTSG-GL.23
Testing of plans
EIOPA-ICTSG-GL.24
Crisis communications
EIOPA-ICTSG-GL.25
Outsourcing of ICT services and ICT systems
EIOPA-ICTSG-GL.5
Audit
EIOPA-ICTSG-GL.7
Information security function
EIOPA-ICTSG-GL.9
Physical security
Show the 13 you already have
EIOPA-ICTSG-GL.11
Security monitoring
EIOPA-ICTSG-GL.15
ICT incident and problem management
EIOPA-ICTSG-GL.21
Business continuity planning
EIOPA-ICTSG-GL.8
Logical security
EIOPA-ICTSG-GL.10
ICT operations security
EIOPA-ICTSG-GL.14
ICT operations management
EIOPA-ICTSG-GL.19
Business continuity management
EIOPA-ICTSG-GL.2
ICT within the system of governance
EIOPA-ICTSG-GL.20
Business impact analysis
EIOPA-ICTSG-GL.22
Response and recovery plans
EIOPA-ICTSG-GL.3
ICT strategy
EIOPA-ICTSG-GL.4
ICT and security risks within the risk management system
EIOPA-ICTSG-GL.6
Information security policy and measures

How this is calculated

Already covered means a mapping runs from a control in NIST Cybersecurity Framework 2.0 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition