| Scope and covered activity | Essential and important entities in NIS2 sectors, including digital infrastructure, ICT service management, and digital providers where the directive and national rules bring the entity into scope. | Information-security controls for the provision and use of cloud services, extending ISO/IEC 27002 guidance for cloud service customers and cloud service providers. | Write two scope findings first: legal entity/service scope for NIS2, and cloud customer/provider control scope for ISO/IEC 27017. |
|---|
| Who must act | Management bodies, security leaders, incident-response teams, supplier-risk owners, legal/compliance teams, and country or sector operations owners for the NIS2-scoped entity. | Cloud service customers and cloud service providers, with role-specific responsibilities for policies, controls, monitoring, event reporting, evidence, and service termination. | Assign legal accountability and cloud operational ownership separately; one register can coordinate both, but each evidence item needs the right owner. |
|---|
| Trigger or threshold | Entity classification, sector inclusion, size-cap or special-case rules, national transposition, and significant incidents trigger NIS2 workstreams. | Use or provision of cloud services triggers ISO/IEC 27017 mapping when cloud-specific risks, customer/provider responsibilities, or cloud control evidence must be defined. | Do not use cloud-control adoption as a shortcut for NIS2 applicability; run the legal scope test and the cloud control test separately. |
|---|
| Core obligations and controls | Article 21 cybersecurity risk-management measures, Article 23 incident reporting, management-body accountability, supply-chain controls, and applicable registration or authority communication duties. | Additional implementation guidance for ISO/IEC 27002 controls and cloud-specific controls, including shared roles, supplier relationships, monitoring, incident coordination, and provider/customer evidence. | Convert legal duties and cloud controls into owner assignments, product requirements, supplier clauses, monitoring procedures, incident playbooks, and evidence requests. |
|---|
| Evidence and records | Entity classification, country notes, Article 21 control evidence, policy approvals, incident logs, authority notifications, supplier files, and management-body records. | Cloud policy, shared-responsibility matrix, provider capability evidence, cloud monitoring records, incident contact procedures, configuration evidence, audit reports, and asset return or deletion records. | Reuse cloud evidence only after labelling the NIS2 article or national duty it supports and the ISO/IEC 27017 cloud responsibility it proves. |
|---|
| Timing and cadence | NIS2 timing depends on Member State transposition, applicable registration duties, risk-management review triggers, and the Article 23 incident sequence including early warning, notification, and final report steps. | ISO/IEC 27017 timing follows cloud risk assessment, customer/provider agreement, implementation, monitoring, event-reporting procedures, audit or assurance requests, and termination or asset-removal events. | Calendar the earliest legal or operational clock and add reassessment triggers for product, cloud provider, supplier, country, incident, system, and contract changes. |
|---|
| Enforcement or assurance route | National competent authorities supervise and enforce NIS2, with differentiated supervision for essential and important entities and penalties under the directive and national law. | ISO/IEC 27017 is assurance-oriented: customers, providers, auditors, contracts, independent evidence, and internal governance decide whether cloud controls are implemented and operated. | Escalate through the route that owns the actual source: regulator for NIS2, and customer/provider governance, contract management, or audit assurance for ISO/IEC 27017. |
|---|
| Overlap and reuse | NIS2 can reuse cloud inventories, logs, supplier records, business-continuity evidence, vulnerability records, and incident procedures when they prove the specific NIS2 duty. | ISO/IEC 27017 can reuse NIS2 evidence when it proves the cloud customer/provider responsibility and remains tied to the relevant cloud service, control, and risk assessment. | Reuse common evidence, but label each record by legal duty, cloud role, control purpose, owner, and review trigger. |
|---|
| Practical decision rule | For NIS2, record the entity and sector conclusion, Member State assumptions, article or national duty, owner, evidence artifact, and reassessment trigger. | For ISO/IEC 27017, record the cloud customer/provider role, cloud service boundary, control or guidance point, owner, evidence artifact, and reassessment trigger. | The first useful output is a short decision record that legal, security, cloud, procurement, incident-response, and audit reviewers can re-run from the same sources. |
|---|