From regulation to controls

Scope: one instrument turned into a control set · Who: the compliance lead who owns the mapping · Prerequisites: the official text and a control inventory · First result: one register

1. Why this exists (the failure mode it prevents)#

Most regulatory mapping ends in one spreadsheet: article numbers, control identifiers, a colour. It is opened again only when someone outside asks a question.

The question has a predictable shape. Show how Article 21(2)(d) is met. Show where the vulnerability-handling evidence for this product sits. The spreadsheet answers neither, because it never captured what the obligation requires, what was decided, or which record proves it.

What follows is a finding or an information request. Under NIS2 a competent authority may require evidence of implementation of cybersecurity policies, such as security audit results ¹. Under the Cyber Resilience Act a manufacturer must hold technical documentation covering every essential requirement, and a justification wherever one does not apply ².

The method below replaces the spreadsheet with a chain: identifier, objective, control, record, owner. An answer then becomes producible on demand, not assembled under pressure.

2. Definitions (only the ones that cause disputes)#

Nine terms carry most of the argument.

Term	Working definition	Source
Obligation	The smallest piece of an instrument that can be complied with, breached and pointed at: a paragraph or lettered point. Article 21(2) carries ten.	3
Control objective	The outcome intended, stated so an outsider can test whether it holds. It names no mechanism.	Clause 6.2, Information security objectives and planning to achieve them 4
Control	The mechanism chosen to produce the objective, determined from the treatment decision and only then compared against the reference set.	Clause 6.1.3; Annex A, Information security controls reference 5
Evidence	A record an outsider can inspect, with a producer, frequency and retention. A system name is a location.	Clause 7.5.3, Control of documented information 6
Owner	The role accountable for the objective holding true, distinct from the body approving the measures.	Clause 5.3, Organizational roles, responsibilities and authorities 7
In scope vs applicable	In scope: the instrument reaches this entity or product. Applicable: a given obligation inside it bites here. The CRA demands a written justification where it does not.	8
Product with digital elements	A software or hardware product and its remote data processing solutions, reached where use includes a logical or physical connection to a network.	9
Manufacturer	Whoever develops such a product, or has one developed, and markets it under their own name. Whoever substantially modifies one and makes it available is a manufacturer for the part affected, or for the whole product where its cybersecurity as a whole is affected.	10
Important and critical class	Important: the core functionality of an Annex III category, in class I or class II, routed under Article 32(2) and (3). Critical: an Annex IV category, which may need a certificate at assurance level at least substantial.	11

3. The method — numbered steps, each with input, activity, output and owner#

Eight steps in dependency order, each with an input, an activity, a named output and an owning role.

3.1 Fix the scope before touching any control#

Scope is two questions: does the instrument reach this organisation or product, and in what capacity? For NIS2 the answer comes from Articles 2 and 3. An Annex I entity above the medium-sized ceilings is essential. So are qualified trust service providers, top-level domain name registries and DNS service providers, whatever their size. Everything else of a listed type is important ¹². The class sets the supervisory regime. Essential entities face a comprehensive ex ante and ex post regime; important entities a light, ex post only, regime acted on when non-compliance is indicated ¹³.

For the CRA the questions are the operator role and the product class. The four roles carry different obligation sets, and a substantial modification moves Articles 13 and 14 onto whoever made it ¹⁴. Class decides the conformity route ¹⁵.

• Input: the official text; sector, headcount and turnover data; the product portfolio with connectivity and core function.
• Activity: run each test in order; record the answer and the article behind it; list what it excludes, and why.
• Output: scope determination memo, one citation per step, with an exclusion list.
• Owner: compliance lead drafts; legal counsel confirms contested steps.

3.2 Decompose the instrument into obligations#

The unit is the paragraph or lettered point. Mapping at article level is the commonest defect: one article holds obligations with different owners, evidence and clocks. Article 13 of the CRA carries twenty-five paragraphs ¹⁶, and a row against "Article 13" cannot be evidenced.

Build each identifier from instrument, article, paragraph and point, so NIS2-21-2-d reads the same in a register, a ticket and a finding. Identifiers are never reused or renumbered, and a removed obligation is closed with a date so a past assessment still resolves. Mark the addressee too: a directive binds Member States, so several NIS2 obligations reach an organisation only through the transposing act ¹⁷.

• Input: the official text, read in full rather than through a summary.
• Activity: split to paragraph or point; paraphrase each in one sentence; record the citation; flag obligations addressed to Member States.
• Output: obligation register with identifier, citation, paraphrase and applicability flag.
• Owner: compliance lead.

3.3 Classify each obligation#

Five classes are enough: governance, organisational, technical, reporting and documentation. The class predicts the owner, the evidence type and the review cadence. A register that is almost all technical has skipped the governance obligations an authority opens with.

• Input: the obligation register from step 3.2.
• Activity: assign one class per obligation; where one spans two, split the row rather than tagging both.
• Output: obligation register with a class column and a distribution count.
• Owner: compliance lead.

3.4 Write one control objective per obligation#

One obligation, one objective. Three rules keep objectives usable: state a condition capable of being false, name the population, and include the interval that measures it. "Manage supply chain risk" fails all three. "Every direct supplier inside scope holds a current assessment of its vulnerabilities and secure development practice, refreshed annually" passes. It traces to Article 21(3), which asks entities to weigh each direct supplier's vulnerabilities ¹⁸.

• Input: the classified register.
• Activity: write the objective; test it against the three rules; have the owner confirm they could be held to it.
• Output: obligation register with an objective column, confirmed by the owners.
• Owner: compliance lead writes; the accountable role confirms.

3.5 Select or design controls, and name the gaps#

Only now does a control set enter. Determine what is necessary from the objective, then compare that against the reference set for omissions. ISO/IEC 27001:2022 asks for that order at clause 6.1.3, where Annex A is the comparison set, not the starting inventory ⁵.

Two outcomes are legitimate. Either an existing control already produces the objective, or nothing covers it and a new control is designed. The second is common with product regulation. No reference control matches a software bill of materials or a coordinated disclosure policy, both of which the CRA requires ¹⁹. A register that never records a gap was written backwards.

• Input: the register with objectives; the control inventory and Statement of Applicability.
• Activity: map each objective to existing controls; mark partial coverage as partial; design controls for the rest; record every addition against the Statement of Applicability.
• Output: control mapping matrix, coverage recorded as full, partial or none, plus a gap list.
• Owner: compliance lead owns the matrix; control owners confirm what their control does.

3.6 Define the evidence per control#

Evidence is a record, not a system. Four fields make it inspectable: the record, its producer, how often, and how long it is kept. Retention is sometimes a legal figure. Technical documentation and the declaration of conformity stay available to market surveillance authorities for ten years, or the support period if longer ²⁰. Each security update stays available for ten years or the rest of that period ²¹. NIS2 sets no equivalent rule.

• Input: the control mapping matrix.
• Activity: name the record per control, with producer, frequency and retention; check it exists, and open an action where it does not.
• Output: evidence catalogue, one row per record, cross-referenced to obligation identifiers.
• Owner: compliance lead owns the catalogue; each record's producer owns the record.

3.7 Assign owners as roles#

Two owner columns, not one. The accountable role answers for the objective; the approving body signs off the measure set. Under NIS2 those differ: management bodies approve the measures, oversee implementation, can be held liable, and must themselves follow training ²². Never record a person; a register of names decays at the first reorganisation.

• Input: the evidence catalogue and the organisation's role model.
• Activity: assign an accountable role per obligation and an approving body; check no role owns more than it can evidence; record the approval with a date.
• Output: owner matrix; the minuted approval of the measure set.
• Owner: compliance lead prepares; the management body approves.

3.8 Keep the mapping alive#

A register with no change triggers will be wrong within a year. Six triggers cover most movement, each naming the artefact it reopens.

• Amendment. The register is re-decomposed; closed rows are dated, never deleted.

• Implementing acts. NIS2 required implementing acts by 17 October 2024 for the listed digital categories ²³. That act is Commission Implementing Regulation (EU) 2024/2690 ²⁴; objectives then follow its wording.

• Delegated acts. The Commission may amend the Annex III categories, set minimum support periods, and add Annex VII elements ²⁵.

• Harmonised standards. A product conforming to a harmonised standard published in the Official Journal is presumed to conform to what that standard covers ²⁶. A new publication can retire a bespoke control.

• National transposition. Member States adopted the NIS2 measures by 17 October 2024 and apply them from 18 October 2024 ¹⁷. Sweden's Cybersäkerhetslag (2025:1506) took effect on 15 January 2026 ²⁷; the citation column moves to the national act.

• Product change. A substantial modification brings Articles 13 and 14 onto the modified part ²⁸. Series production carries its own conformity duty ²⁹.

• Input: the four artefacts, plus a watchlist of the instruments and standards touching them.

• Activity: review the watchlist quarterly; open the affected artefact per hit; record the review even when nothing moved.

• Output: change-trigger watchlist with a dated review record.

• Owner: compliance lead, fed by horizon scanning.

Worked pass A — Directive (EU) 2022/2555, Article 21(2)#

The Article 21 measures must be appropriate and proportionate, rest on an all-hazards approach, and protect the physical environment too ³⁰. Paragraph 2 sets a floor of ten, at points (a) to (j). The table takes each through steps 3.3, 3.6 and 3.7; objective and controls are in section 7.

ID	Class	Evidence record	Owner
NIS2-21-2-a	governance	Risk methodology; register with owner and acceptance date	Compliance lead
NIS2-21-2-b	organisational	Incident record with classification, timestamps, significance decision	Incident manager
NIS2-21-2-c	organisational	Restore-test result; exercise report; crisis contact list, tested	Continuity manager
NIS2-21-2-d	organisational	Supplier assessment with date; contract terms; reassessment schedule	Procurement
NIS2-21-2-e	technical	Gate records with the security decision; remediation queue with times	Engineering lead
NIS2-21-2-f	governance	Measurement results; independent review report; a change traced to one	Compliance lead
NIS2-21-2-g	organisational	Per-person completion record; management-body attendance record	People function
NIS2-21-2-h	technical	Cryptographic standard; key inventory with rotation dates; review output	Engineering lead
NIS2-21-2-i	organisational	Leaver disablement times; access review results; asset owners	People and technology operations
NIS2-21-2-j	technical	Authentication coverage report; out-of-band channel test record	Technology operations

Four duties sit around it. Article 20(1) puts approval and oversight on the management body, with liability attached; Article 20(2) requires its members to follow training. Article 21(4) requires an entity that finds it does not comply to take corrective measures without undue delay ³¹. Article 23(4) sets the clock: early warning within 24 hours of awareness, notification within 72 hours, final report within one month ³². Significance is defined at Article 23(3) by severe disruption or financial loss, or considerable damage to others ³³.

Worked pass B — Regulation (EU) 2024/2847, manufacturer obligations#

The CRA has a product half and a process half. A product may be made available only where it meets the requirements in Annex I Part I. The manufacturer's processes must meet the vulnerability-handling requirements in Part II ³⁴. Part I point (2) lists thirteen product properties, at (a) to (m); Part II lists eight process requirements ³⁵.

ID	Obligation, in short	Class	Evidence record	Owner
CRA-13-01	Build to the requirements in Annex I Part I	technical	Conformity record per requirement, per version	Product owner
CRA-13-03	Document the product risk assessment; state how each Part I requirement applies, and justify what does not	documentation	Dated assessment with applicability statement and justifications	Product security lead
CRA-13-05	Due diligence on third-party and open-source components; report upstream	organisational	Due-diligence record; upstream report log	Engineering lead
CRA-13-08	Set the support period; hold a coordinated disclosure policy	governance	Determination record; published disclosure policy	Product owner
CRA-13-09	Keep each update available ten years, or the rest of the period	technical	Update archive; retrieval sample	Release engineering
CRA-13-12	Documentation, assessment, declaration, CE marking; series production stays in conformity	documentation	The four artefacts, dated; change record with the conformity decision	Product compliance role
CRA-13-17	A single contact for users; support-period end date at purchase	organisational	Published contact with response times; purchase-path evidence	Product security lead
CRA-13-21	Immediate corrective measures on known non-conformity	governance	Non-conformity record with decision and date	Product owner
CRA-14-02	Notify an actively exploited vulnerability, and a severe incident	reporting	Timestamped submissions; awareness and severity records	Product security lead
CRA-A1-II-1	Produce a bill of materials; disclose fixed vulnerabilities	documentation	Machine-readable bill of materials; published advisories	Engineering lead

Both reporting duties share a route: simultaneously to the CSIRT designated as coordinator and to ENISA, through the single reporting platform ³⁶. For a vulnerability the final report is due within 14 days of a corrective or mitigating measure becoming available. For a severe incident it is due within one month of the 72-hour notification ³⁷. Severity has two tests. One is an effect on the product's ability to protect sensitive data or functions. The other is the introduction or execution of malicious code ³⁸.

The evidence catalogue has a spine here. Annex VII lists eight items the technical documentation must contain, from the product and process descriptions to the bill of materials ³⁹. Two dates set the sequencing. Article 14 applies from 11 September 2026 and the rest of the Regulation from 11 December 2027 ⁴⁰. Products placed on the market before that date escape the substantive requirements unless substantially modified, yet the Article 14 duties reach all of them ⁴¹. A shipped fleet reports long before the essential requirements apply.

4. Deliverables#

Four artefacts carry the method and two support it. No template ships yet, so the column says so.

Deliverable	Format	Template	Retention
Scope determination memo	document	template pending	current plus one certification cycle
Obligation register	spreadsheet or register	template pending	life of the instrument; closed rows kept
Control mapping matrix	spreadsheet or register	template pending	every version, whole cycle
Evidence catalogue	register	template pending	as long as the longest record it points at
Owner matrix	register	template pending	current plus one cycle, approval dates kept
Change-trigger watchlist	register	template pending	whole cycle, with the dated review record

For CRA artefacts the retention floor is legal; for NIS2 artefacts it is a choice, held in the document control register under ISO/IEC 27001:2022 clause 7.5.3 ⁶.

5. What the auditor or authority will ask#

Each question is answered by one artefact from section 4, via the obligation identifier. More than two hops means the chain is broken.

6. Failure modes and how they surface as findings#

Five patterns account for most of the avoidable damage: the pattern, the finding it produces, and the smallest fix.

7. Mapping to standards#

Each row carries its own article citation, read at the EU Publications Office. Annex A control titles come from the ISO Online Browsing Platform contents listing ⁴², as do the ISO/IEC 27001:2022 clause titles ⁴³. That listing stops at 8.1, so technological controls are cited at clause level.

Art. 21(2)	Control objective, in short	Annex A controls	Verified
(a) Risk analysis and security policies	Risk analysis runs to approved criteria, each entry with an owner	A.5.1 Policies for information security; A.5.2 Information security roles and responsibilities	44
(b) Incident handling	Incidents are classified against written significance criteria	A.5.24 to A.5.27, the information security incident management controls	45
(c) Continuity, backup, recovery, crisis management	Recovery targets are met under test; crisis roles sit above technology	ISO/IEC 27002:2022 clause 5, Organizational controls, at clause level	46
(d) Supply chain security	Every direct supplier in scope holds a current assessment	A.5.19 Information security in supplier relationships, through A.5.22 Monitoring, review and change management of supplier services	47
(e) Acquisition, development, maintenance; vulnerability handling	Security enters at design; vulnerabilities carry a clock	ISO/IEC 27002:2022 clause 8, Technological controls, at clause level	48
(f) Assessing the effectiveness of the measures	Each measure has a check; one result changed something this cycle	A.5.35 Independent review of information security; A.5.36 Compliance with policies, rules and standards for information security	49
(g) Cyber hygiene and training	Everyone trains for their role, the management body separately	A.6.3 Information security awareness, education and training	50
(h) Cryptography and encryption	Algorithms and key lifecycles are defined; configurations match	ISO/IEC 27002:2022 clause 8, Technological controls, at clause level	51
(i) HR security, access control, asset management	Joiner, mover and leaver changes complete within a stated interval	ISO/IEC 27002:2022 clauses 5 and 6, at clause level	52
(j) Multi-factor or continuous authentication; secured and emergency communications	Authentication covers the stated population; one channel survives an outage	ISO/IEC 27002:2022 clauses 5 and 8, at clause level	53

Article or Annex item	Control objective, in short	Controls, and the gap	Verified
Art. 13(1); Annex I Part I	A recorded decision covers each Part I requirement, per version	Clause 8, at clause level. Gap: product properties are not a management-system control	54
Art. 13(2) to 13(4)	A current product risk assessment exists per version	Clauses 6.1.2 and 8.2, as a separate product register. Gap: the scope is the product	55
Art. 13(5), 13(6)	No component ships unchecked; upstream reports go on a clock	A.5.19 to A.5.22, supplier controls. Gap: reporting a fix upstream	56
Art. 13(8), 13(9); Annex I Part II point (5)	The support period rests on recorded grounds; the policy is public	A.5.1 Policies for information security. Gap: a declared support period has none	57
Art. 13(12) to 13(14); Art. 31	The four conformity artefacts stay retrievable through change	Clause 7.5.3 Control of documented information; clause 8.1 Operational planning and control; A.5.37 Documented operating procedures	58
Art. 13(17), 13(19), 13(21)	A contact is published, the end date shows at purchase, non-conformity is corrected	Clause 10.2 Nonconformity and corrective action; A.5.24 to A.5.27, partly. Gap: an external intake address	59
Art. 14(1) to 14(4)	Submissions leave within the 24-hour, 72-hour and final windows	A.5.24 to A.5.27, incident management. Gap: the external clock, the two-recipient route, the statutory severity test	60
Annex I Part II points (1), (3), (4), (7), (8)	Each release carries a bill of materials, is tested, and ships advisories	A.5.35 and A.5.36 for testing; clause 8 for distribution. Gap: no reference control requires a bill of materials	61

8. Checklist#

Each item is observable; "mapped" is not.

• The scope memo carries one citation per test step and lists the exclusions.
• Every obligation row sits at paragraph or lettered-point level, never article level.
• Each obligation carries one control objective stating a condition capable of being false.
• The mapping matrix records coverage as full, partial or none, and the gap list is not empty by accident.
• Every control added where the reference set had none sits in the Statement of Applicability.
• Every control has a named evidence record with producer, frequency and retention.
• Retention for CRA artefacts meets the ten-year floor, or the support period if longer.
• Every obligation has an accountable role, and no obligation names a person.
• Management-body training under Article 20(2) has a record per member.
• The watchlist names the instruments, delegated and implementing acts, and standards.

References#

Primary sources only.

1. European Parliament and Council. Directive (EU) 2022/2555 (NIS 2 Directive). OJ L 333, 27.12.2022, p. 80. Read at https://publications.europa.eu/resource/celex/32022L2555 ⁶²
2. European Parliament and Council. Regulation (EU) 2024/2847 (Cyber Resilience Act). OJ L, 2024/2847, 20.11.2024. Read at https://publications.europa.eu/resource/celex/32024R2847 ⁶³
3. European Commission. Commission Implementing Regulation (EU) 2024/2690. https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng ²⁴
4. ISO/IEC. Information security management systems — Requirements. ISO/IEC 27001:2022. Read at https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-3:v1:en ⁴³
5. ISO/IEC. Information security controls. ISO/IEC 27002:2022. Read at https://www.iso.org/obp/ui/#iso:std:iso-iec:27002:ed-3:v2:en ⁴²
6. Sveriges riksdag. Cybersäkerhetslag (2025:1506), in force 15 January 2026. https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/cybersakerhetslag-20251506_sfs-2025-1506/ ²⁷

Cadences and retention periods are organisational choices unless an article sets the figure.