Article 25Standardisation
1. In order to promote the convergent implementation of Article 21(1) and (2), Member States shall, without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the security of network and information systems.
2. ENISA, in cooperation with Member States, and, where appropriate, after consulting relevant stakeholders, shall draw up advice and guidelines regarding the technical areas to be considered in relation to paragraph 1 as well as regarding already existing standards, including national standards, which would allow for those areas to be covered.
NIS2, the European Union directive on network and information security, Article 25
To promote convergent implementation of Article 21(1) and (2), Member States must encourage the use of European and international standards and technical specifications relevant to the security of network and information systems, without imposing or discriminating in favour of a particular type of technology. ENISA, with Member States and after consulting stakeholders where appropriate, draws up advice and guidelines on the technical areas to consider and on existing standards, including national ones, that would cover them.
The duty is to encourage. Nothing here makes a standard mandatory, and the article does not say that adopting one satisfies Article 21. Article 21(1) separately lists relevant European and international standards, where applicable, among the matters taken into account in setting the level of security. A standard is therefore one input to that judgement; the article leaves open how an authority will weigh it.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.