NIS2 – Control Mapping

This page shows which Wombat controls cover which requirements of NIS2.

Framework Control	Requirement	Wombat Controls	Severity	Pillar	Category
Art. 21(2)(b) – Incident handling	Art. 21(2)(b) – Incident handling	WAF-SEC-080 · WAF-SEC-100	🟠 🟡	Security	identity-access
Art. 21(2)(b) – Incident handling and vulnerability management	Art. 21(2)(b) – Incident handling and vulnerability management	WAF-SEC-070	🟡	Security	container-security
Art. 21(2)(c) – Network and information system security	Art. 21(2)(c) – Network and information system security	WAF-SEC-050 · WAF-SEC-120	🟠	Security	identity-access, network-security
Art. 21(2)(d) – Network and information security	Art. 21(2)(d) – Network and information security	WAF-SEC-140	🟠	Security	network-security
Art. 21(2)(d) – Supply chain and data location requirements	Art. 21(2)(d) – Supply chain and data location requirements	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
Art. 21(2)(d) – Supply chain security	Art. 21(2)(d) – Supply chain security	WAF-SEC-110	🟠	Security	container-security
Art. 21(2)(d) – Supply chain security and compliance	Art. 21(2)(d) – Supply chain security and compliance	WAF-SEC-090	🟡	Security	identity-access
Art. 21(2)(e) – Security in handling of data	Art. 21(2)(e) – Security in handling of data	WAF-SEC-130	🟠	Security	identity-access
Art. 21(2)(f) – Incident handling	Art. 21(2)(f) – Incident handling	WAF-SEC-160	🟠	Security	logging-monitoring
Art. 21(2)(g) – Vulnerability handling and disclosure	Art. 21(2)(g) – Vulnerability handling and disclosure	WAF-SEC-150	🟠	Security	container-security
Art. 21(2)(h) – Cryptography and credential protection	Art. 21(2)(h) – Cryptography and credential protection	WAF-SEC-060	🔴	Security	identity-access
Art. 21(2)(h) – Cryptography and encryption	Art. 21(2)(h) – Cryptography and encryption	WAF-SEC-040	🟠	Security	identity-access
Art. 21(2)(h) – Cryptography and encryption policies	Art. 21(2)(h) – Cryptography and encryption policies	WAF-SEC-030	🟠	Security	identity-access
Art. 21(2)(i) – Access control measures	Art. 21(2)(i) – Access control measures	WAF-SEC-020	🔴	Security	identity-access
Art. 21(2)(i) – Human resources security and access control	Art. 21(2)(i) – Human resources security and access control	WAF-SEC-010	🔴	Security	identity-access
Art. 23 – Reporting obligations	Art. 23 – Reporting obligations	WAF-SEC-080	🟠	Security	identity-access
Art. 23 – Reporting obligations (24/72 hour notifications)	Art. 23 – Reporting obligations (24/72 hour notifications)	WAF-SEC-100	🟡	Security	identity-access

Framework Control

Requirement

Wombat Controls

Severity

Pillar

Category

Art. 21(2)(b) – Incident handling

WAF-SEC-080 · WAF-SEC-100

🟠 🟡

Security

identity-access

Art. 21(2)(b) – Incident handling and vulnerability management