Skip to content
RGPD

Article 25

Standardisation

1.   In order to promote the convergent implementation of Article 21(1) and (2), Member States shall, without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the security of network and information systems.

2.   ENISA, in cooperation with Member States, and, where appropriate, after consulting relevant stakeholders, shall draw up advice and guidelines regarding the technical areas to be considered in relation to paragraph 1 as well as regarding already existing standards, including national standards, which would allow for those areas to be covered.

Common Questions

Frequently Asked Questions

Why does NIS2 emphasize using European and international standards?
NIS2 encourages using European and international standards to make sure network and information systems are secure across all Member States in a similar way, creating consistency and compatibility, but without favoring any specific type of technology, allowing for fair and open technology use while promoting security.
What role does ENISA play under NIS2 in standardizing cybersecurity?
Under NIS2, ENISA works closely with Member States and other important stakeholders to develop advice and guidelines on the technical areas needing attention and to identify existing standards, including national ones, that effectively address network and information system security across the European Union.
Are Member States forced to use specific cybersecurity technologies according to NIS2?
No, the NIS2 directive does not force Member States to adopt any specific technology; instead, it stresses the importance of neutrality, meaning countries should avoid discrimination by encouraging multiple standards or technologies that serve security purposes, ensuring all systems maintain good cybersecurity practices without limiting technological innovation.
What are technical specifications, and why are they important under NIS2?

Technical specifications explain clearly how a system or product should be built or function to meet security and performance standards;

under NIS2, following these specifications helps organizations achieve a consistent, high level of cybersecurity across Europe by providing clear guidance on acceptable security measures for network and information systems.

← Article 24 Article 26 →