{
  "metadata": {
    "document_id": "GAISSF-CRO-029",
    "title": "GAISSF–NIS2 Mapping",
    "version": "1.0",
    "status": "Draft for Publication",
    "publisher": "ODA3 Institute",
    "legal_entity": "ODA3 Pvt Ltd",
    "publication_date": "2026-06-29",
    "verification_date": "2026-10-06",
    "gaissf_baseline": "GAISSF™ v1.0; GAISSF-NOR-001 and GAISSF-NOR-004; 59 controls / 9 domains; Applicable-Control Baseline = all 52 controls in D1-D8 plus D9 where Physical AI or cyber-physical actuation is in scope.",
    "external_baseline": "Directive (EU) 2022/2555 (NIS2), OJ L 333, 27 December 2022; in force.",
    "transposition_deadline": "17 October 2024",
    "implementation_layer": "Commission Implementing Regulation (EU) 2024/2690; in force; separate directly applicable technical/methodological and significant-incident layer for specified entity classes.",
    "warning": "A directive is transposed through Member State law. This crosswalk is not a country-specific legal compliance determination, regulator-acceptance finding, evidence-sufficiency finding, or operating-effectiveness conclusion.",
    "transposition_status": "Commission country-by-country state-of-play must be checked. On 8 July 2026 the Commission announced referrals of Ireland, Spain, France and the Netherlands to the CJEU for failure to notify NIS2 transposition measures."
  },
  "controls": [
    {
      "id": "D1-CTL-01",
      "title": "Dataset Provenance & Poisoning Prevention",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-02",
      "title": "Model Extraction Resistance",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-03",
      "title": "Behavioral Drift Detection",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-04",
      "title": "Federated Learning Poisoning Prevention",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-05",
      "title": "Embedding Space Robustness",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-06",
      "title": "Post-Quantum Model Signing & Crypto Hardening",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-07",
      "title": "Lora/Adapter Integrity Verification",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-08",
      "title": "Model Merge Attack Detection",
      "domain": "D1",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D1-CTL-09",
      "title": "Quantization Backdoor Screening",
      "domain": "D1",
      "summary": "Implementation by Tier D2 — RUNTIME SECURITY & ADVERSARIAL DEFENSE",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-01",
      "title": "Direct Prompt Injection Prevention",
      "domain": "D2",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-02",
      "title": "Indirect Prompt Injection Prevention",
      "domain": "D2",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-03",
      "title": "Jailbreak Resistance Testing",
      "domain": "D2",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-04",
      "title": "Multi-Modal Injection Defense",
      "domain": "D2",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-05",
      "title": "Function Call/Tool Call Injection Prevention",
      "domain": "D2",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D2-CTL-06",
      "title": "Cross-Context Hijacking Mitigation",
      "domain": "D2",
      "summary": "Implementation by Tier D3 — AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-01",
      "title": "Least Agency Enforcement",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-02",
      "title": "Inter-Agent Communication Security",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-03",
      "title": "Agentic Prompt Chaining Detection",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-04",
      "title": "Embodied Ai Safety Controls",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-05",
      "title": "Multi-Agent Trust Chain Attestation",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-06",
      "title": "Persistent Memory Exfiltration Prevention",
      "domain": "D3",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D3-CTL-07",
      "title": "Secure Memory Lifecycle Management",
      "domain": "D3",
      "summary": "Implementation by Tier D4 — SUPPLY CHAIN & THIRD-PARTY AI SECURITY",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-01",
      "title": "Ai Bill Of Materials (Ai Bom) Maintenance",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-02",
      "title": "Model File & Artifact Scanning",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-03",
      "title": "Model Hub & Registry Vetting",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-04",
      "title": "Mcp Server Behavioral Monitoring",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-05",
      "title": "Third-Party Ai Api Security Assessment",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-06",
      "title": "Shadow Ai Discovery & Governance",
      "domain": "D4",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D4-CTL-07",
      "title": "Ai Software Composition Analysis (Sca)",
      "domain": "D4",
      "summary": "Implementation by Tier D5 — CONTENT SAFETY & OUTPUT INTEGRITY",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-01",
      "title": "Harmful Content Blocking",
      "domain": "D5",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-02",
      "title": "Pii Leakage Prevention",
      "domain": "D5",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-03",
      "title": "Copyright Detection",
      "domain": "D5",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-04",
      "title": "Ai Watermarking Robustness",
      "domain": "D5",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-05",
      "title": "Privacy-By-Design Verification",
      "domain": "D5",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D5-CTL-06",
      "title": "Privacy-Preserving Ml Validation",
      "domain": "D5",
      "summary": "Implementation by Tier D6 — GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-01",
      "title": "Human-In-The-Loop For High-Risk Actions",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-02",
      "title": "Audit Trail Completeness",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-03",
      "title": "Ai Model Card Completeness",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-04",
      "title": "Ai Incident Response Readiness",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-05",
      "title": "Model Deprecation & Decommissioning",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-06",
      "title": "Third-Party Ai Vendor Governance",
      "domain": "D6",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D6-CTL-07",
      "title": "Ai Resilience & Business Continuity",
      "domain": "D6",
      "summary": "Implementation by Tier D7 — HUMAN & SOCIETAL HARMS",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D7-CTL-H01",
      "title": "Ai-Generated Phishing Simulation",
      "domain": "D7",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D7-CTL-H02",
      "title": "Deepfake Detection Training",
      "domain": "D7",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D7-CTL-H03",
      "title": "Out-Of-Band Authentication",
      "domain": "D7",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D7-CTL-H04",
      "title": "Ai Social Engineering Ir",
      "domain": "D7",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D7-CTL-H05",
      "title": "Ai-Enhanced External Attack Defense",
      "domain": "D7",
      "summary": "Implementation by Tier D8 — REGULATORY ALIGNMENT & COMPLIANCE",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D8-CTL-01",
      "title": "Eu Ai Act Risk Tier Mapping",
      "domain": "D8",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D8-CTL-02",
      "title": "Iso 42001 Gap Analysis",
      "domain": "D8",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D8-CTL-03",
      "title": "Gpai Technical Documentation Verification",
      "domain": "D8",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D8-CTL-04",
      "title": "Dora Ict Incident Reporting (Financial Sector)",
      "domain": "D8",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D8-CTL-05",
      "title": "Nist Sp 800-218A Compliance Check",
      "domain": "D8",
      "summary": "Implementation by Tier D9 — PHYSICAL AI SAFETY",
      "applicable_control_baseline": "Canonical D1-D8 Applicable-Control Baseline"
    },
    {
      "id": "D9-CTL-01",
      "title": "Physical Harm Boundary Enforcement",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-02",
      "title": "Safe State And Graceful Degradation",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-03",
      "title": "Human Override And Emergency Stop",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-04",
      "title": "Cyber-Physical Attack Detection",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-05",
      "title": "Physical Environment Integrity Monitoring",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-06",
      "title": "Actuator Command Verification",
      "domain": "D9",
      "summary": "Implementation by Tier",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    },
    {
      "id": "D9-CTL-07",
      "title": "Physical Incident Evidence Preservation",
      "domain": "D9",
      "summary": "Implementation by Tier Annex A — Control Count Reconciliation",
      "applicable_control_baseline": "Additional / conditional; include where Physical AI or cyber-physical actuation is in scope"
    }
  ],
  "articles": [
    {
      "article": 1,
      "title": "Subject matter",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 2,
      "title": "Scope",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 3,
      "title": "Essential and important entities",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 4,
      "title": "Sector-specific Union legal acts",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 5,
      "title": "Minimum harmonisation",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 6,
      "title": "Definitions",
      "chapter": "Chapter I — General provisions"
    },
    {
      "article": 7,
      "title": "National cybersecurity strategy",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 8,
      "title": "Competent authorities and single points of contact",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 9,
      "title": "National cyber crisis management frameworks",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 10,
      "title": "Computer security incident response teams (CSIRTs)",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 11,
      "title": "Requirements, technical capabilities and tasks of CSIRTs",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 12,
      "title": "Cooperation at national level",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks"
    },
    {
      "article": 13,
      "title": "Cooperation Group",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 14,
      "title": "CSIRTs network",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 15,
      "title": "European cyber crisis liaison organisation network (EU-CyCLONe)",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 16,
      "title": "Report on the state of cybersecurity in the Union",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 17,
      "title": "Peer reviews",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 18,
      "title": "Mutual assistance",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 19,
      "title": "Union-level coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter III — Cooperation"
    },
    {
      "article": 20,
      "title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 21,
      "title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 22,
      "title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 23,
      "title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 24,
      "title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 25,
      "title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 26,
      "title": "Jurisdiction and territoriality",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 27,
      "title": "Registry of entities",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 28,
      "title": "Domain name registration data",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 29,
      "title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 30,
      "title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting"
    },
    {
      "article": 31,
      "title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 32,
      "title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 33,
      "title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 34,
      "title": "General conditions for imposing administrative fines",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 35,
      "title": "Infringements entailing a personal data breach",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 36,
      "title": "Penalties",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 37,
      "title": "Delegation of power",
      "chapter": "Chapter VII — Supervision and enforcement"
    },
    {
      "article": 38,
      "title": "Exercise of the delegation",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 39,
      "title": "Committee procedure",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 40,
      "title": "Review",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 41,
      "title": "Transposition",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 42,
      "title": "Amendment of Regulation (EU) No 910/2014",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 43,
      "title": "Amendment of Directive (EU) 2018/1972",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 44,
      "title": "Repeal",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 45,
      "title": "Entry into force",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    },
    {
      "article": 46,
      "title": "Addressees",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions"
    }
  ],
  "mappings": [
    {
      "record_id": "GAISSF-CRO-029-MAP-0001",
      "gaissf_id": "D1-CTL-01",
      "gaissf_title": "Dataset Provenance & Poisoning Prevention",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0002",
      "gaissf_id": "D1-CTL-01",
      "gaissf_title": "Dataset Provenance & Poisoning Prevention",
      "domain": "D1",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0003",
      "gaissf_id": "D1-CTL-01",
      "gaissf_title": "Dataset Provenance & Poisoning Prevention",
      "domain": "D1",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0004",
      "gaissf_id": "D1-CTL-02",
      "gaissf_title": "Model Extraction Resistance",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0005",
      "gaissf_id": "D1-CTL-03",
      "gaissf_title": "Behavioral Drift Detection",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0006",
      "gaissf_id": "D1-CTL-04",
      "gaissf_title": "Federated Learning Poisoning Prevention",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0007",
      "gaissf_id": "D1-CTL-04",
      "gaissf_title": "Federated Learning Poisoning Prevention",
      "domain": "D1",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0008",
      "gaissf_id": "D1-CTL-04",
      "gaissf_title": "Federated Learning Poisoning Prevention",
      "domain": "D1",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0009",
      "gaissf_id": "D1-CTL-05",
      "gaissf_title": "Embedding Space Robustness",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0010",
      "gaissf_id": "D1-CTL-06",
      "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0011",
      "gaissf_id": "D1-CTL-06",
      "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening",
      "domain": "D1",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0012",
      "gaissf_id": "D1-CTL-06",
      "gaissf_title": "Post-Quantum Model Signing & Crypto Hardening",
      "domain": "D1",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0013",
      "gaissf_id": "D1-CTL-07",
      "gaissf_title": "Lora/Adapter Integrity Verification",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0014",
      "gaissf_id": "D1-CTL-08",
      "gaissf_title": "Model Merge Attack Detection",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0015",
      "gaissf_id": "D1-CTL-08",
      "gaissf_title": "Model Merge Attack Detection",
      "domain": "D1",
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0016",
      "gaissf_id": "D1-CTL-08",
      "gaissf_title": "Model Merge Attack Detection",
      "domain": "D1",
      "article": 30,
      "article_title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0017",
      "gaissf_id": "D1-CTL-09",
      "gaissf_title": "Quantization Backdoor Screening",
      "domain": "D1",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0018",
      "gaissf_id": "D2-CTL-01",
      "gaissf_title": "Direct Prompt Injection Prevention",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0019",
      "gaissf_id": "D2-CTL-02",
      "gaissf_title": "Indirect Prompt Injection Prevention",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0020",
      "gaissf_id": "D2-CTL-03",
      "gaissf_title": "Jailbreak Resistance Testing",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0021",
      "gaissf_id": "D2-CTL-04",
      "gaissf_title": "Multi-Modal Injection Defense",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0022",
      "gaissf_id": "D2-CTL-05",
      "gaissf_title": "Function Call/Tool Call Injection Prevention",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0023",
      "gaissf_id": "D2-CTL-06",
      "gaissf_title": "Cross-Context Hijacking Mitigation",
      "domain": "D2",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0024",
      "gaissf_id": "D3-CTL-01",
      "gaissf_title": "Least Agency Enforcement",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0025",
      "gaissf_id": "D3-CTL-02",
      "gaissf_title": "Inter-Agent Communication Security",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0026",
      "gaissf_id": "D3-CTL-03",
      "gaissf_title": "Agentic Prompt Chaining Detection",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0027",
      "gaissf_id": "D3-CTL-04",
      "gaissf_title": "Embodied Ai Safety Controls",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0028",
      "gaissf_id": "D3-CTL-05",
      "gaissf_title": "Multi-Agent Trust Chain Attestation",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0029",
      "gaissf_id": "D3-CTL-06",
      "gaissf_title": "Persistent Memory Exfiltration Prevention",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0030",
      "gaissf_id": "D3-CTL-07",
      "gaissf_title": "Secure Memory Lifecycle Management",
      "domain": "D3",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0031",
      "gaissf_id": "D3-CTL-07",
      "gaissf_title": "Secure Memory Lifecycle Management",
      "domain": "D3",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0032",
      "gaissf_id": "D3-CTL-07",
      "gaissf_title": "Secure Memory Lifecycle Management",
      "domain": "D3",
      "article": 19,
      "article_title": "Union-level coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter III — Cooperation",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Provides entity-level evidence relevant to critical supply-chain risk analysis.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0033",
      "gaissf_id": "D4-CTL-01",
      "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0034",
      "gaissf_id": "D4-CTL-01",
      "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance",
      "domain": "D4",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0035",
      "gaissf_id": "D4-CTL-01",
      "gaissf_title": "Ai Bill Of Materials (Ai Bom) Maintenance",
      "domain": "D4",
      "article": 19,
      "article_title": "Union-level coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter III — Cooperation",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Provides entity-level evidence relevant to critical supply-chain risk analysis.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0036",
      "gaissf_id": "D4-CTL-02",
      "gaissf_title": "Model File & Artifact Scanning",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0037",
      "gaissf_id": "D4-CTL-03",
      "gaissf_title": "Model Hub & Registry Vetting",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0038",
      "gaissf_id": "D4-CTL-03",
      "gaissf_title": "Model Hub & Registry Vetting",
      "domain": "D4",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0039",
      "gaissf_id": "D4-CTL-03",
      "gaissf_title": "Model Hub & Registry Vetting",
      "domain": "D4",
      "article": 19,
      "article_title": "Union-level coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter III — Cooperation",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Provides entity-level evidence relevant to critical supply-chain risk analysis.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0040",
      "gaissf_id": "D4-CTL-04",
      "gaissf_title": "Mcp Server Behavioral Monitoring",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0041",
      "gaissf_id": "D4-CTL-04",
      "gaissf_title": "Mcp Server Behavioral Monitoring",
      "domain": "D4",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0042",
      "gaissf_id": "D4-CTL-05",
      "gaissf_title": "Third-Party Ai Api Security Assessment",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0043",
      "gaissf_id": "D4-CTL-05",
      "gaissf_title": "Third-Party Ai Api Security Assessment",
      "domain": "D4",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0044",
      "gaissf_id": "D4-CTL-05",
      "gaissf_title": "Third-Party Ai Api Security Assessment",
      "domain": "D4",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0045",
      "gaissf_id": "D4-CTL-05",
      "gaissf_title": "Third-Party Ai Api Security Assessment",
      "domain": "D4",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0046",
      "gaissf_id": "D4-CTL-06",
      "gaissf_title": "Shadow Ai Discovery & Governance",
      "domain": "D4",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0047",
      "gaissf_id": "D4-CTL-06",
      "gaissf_title": "Shadow Ai Discovery & Governance",
      "domain": "D4",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0048",
      "gaissf_id": "D4-CTL-06",
      "gaissf_title": "Shadow Ai Discovery & Governance",
      "domain": "D4",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0049",
      "gaissf_id": "D4-CTL-06",
      "gaissf_title": "Shadow Ai Discovery & Governance",
      "domain": "D4",
      "article": 33,
      "article_title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0050",
      "gaissf_id": "D4-CTL-07",
      "gaissf_title": "Ai Software Composition Analysis (Sca)",
      "domain": "D4",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0051",
      "gaissf_id": "D4-CTL-07",
      "gaissf_title": "Ai Software Composition Analysis (Sca)",
      "domain": "D4",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0052",
      "gaissf_id": "D5-CTL-01",
      "gaissf_title": "Harmful Content Blocking",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0053",
      "gaissf_id": "D5-CTL-02",
      "gaissf_title": "Pii Leakage Prevention",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0054",
      "gaissf_id": "D5-CTL-03",
      "gaissf_title": "Copyright Detection",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0055",
      "gaissf_id": "D5-CTL-04",
      "gaissf_title": "Ai Watermarking Robustness",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0056",
      "gaissf_id": "D5-CTL-05",
      "gaissf_title": "Privacy-By-Design Verification",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0057",
      "gaissf_id": "D5-CTL-06",
      "gaissf_title": "Privacy-Preserving Ml Validation",
      "domain": "D5",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0058",
      "gaissf_id": "D5-CTL-06",
      "gaissf_title": "Privacy-Preserving Ml Validation",
      "domain": "D5",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0059",
      "gaissf_id": "D5-CTL-06",
      "gaissf_title": "Privacy-Preserving Ml Validation",
      "domain": "D5",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0060",
      "gaissf_id": "D5-CTL-06",
      "gaissf_title": "Privacy-Preserving Ml Validation",
      "domain": "D5",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0061",
      "gaissf_id": "D6-CTL-01",
      "gaissf_title": "Human-In-The-Loop For High-Risk Actions",
      "domain": "D6",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0062",
      "gaissf_id": "D6-CTL-02",
      "gaissf_title": "Audit Trail Completeness",
      "domain": "D6",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0063",
      "gaissf_id": "D6-CTL-02",
      "gaissf_title": "Audit Trail Completeness",
      "domain": "D6",
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "High",
      "rationale": "Supports incident detection, evidence capture, escalation and reporting workflows, but does not by itself satisfy statutory notification timing and content.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0064",
      "gaissf_id": "D6-CTL-02",
      "gaissf_title": "Audit Trail Completeness",
      "domain": "D6",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0065",
      "gaissf_id": "D6-CTL-02",
      "gaissf_title": "Audit Trail Completeness",
      "domain": "D6",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0066",
      "gaissf_id": "D6-CTL-03",
      "gaissf_title": "Ai Model Card Completeness",
      "domain": "D6",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0067",
      "gaissf_id": "D6-CTL-03",
      "gaissf_title": "Ai Model Card Completeness",
      "domain": "D6",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0068",
      "gaissf_id": "D6-CTL-03",
      "gaissf_title": "Ai Model Card Completeness",
      "domain": "D6",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0069",
      "gaissf_id": "D6-CTL-03",
      "gaissf_title": "Ai Model Card Completeness",
      "domain": "D6",
      "article": 33,
      "article_title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0070",
      "gaissf_id": "D6-CTL-04",
      "gaissf_title": "Ai Incident Response Readiness",
      "domain": "D6",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0071",
      "gaissf_id": "D6-CTL-04",
      "gaissf_title": "Ai Incident Response Readiness",
      "domain": "D6",
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "High",
      "rationale": "Supports incident detection, evidence capture, escalation and reporting workflows, but does not by itself satisfy statutory notification timing and content.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0072",
      "gaissf_id": "D6-CTL-04",
      "gaissf_title": "Ai Incident Response Readiness",
      "domain": "D6",
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0073",
      "gaissf_id": "D6-CTL-04",
      "gaissf_title": "Ai Incident Response Readiness",
      "domain": "D6",
      "article": 30,
      "article_title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0074",
      "gaissf_id": "D6-CTL-05",
      "gaissf_title": "Model Deprecation & Decommissioning",
      "domain": "D6",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0075",
      "gaissf_id": "D6-CTL-06",
      "gaissf_title": "Third-Party Ai Vendor Governance",
      "domain": "D6",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0076",
      "gaissf_id": "D6-CTL-06",
      "gaissf_title": "Third-Party Ai Vendor Governance",
      "domain": "D6",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0077",
      "gaissf_id": "D6-CTL-06",
      "gaissf_title": "Third-Party Ai Vendor Governance",
      "domain": "D6",
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports supply-chain security, supplier due diligence and risk treatment for ICT products and services.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0078",
      "gaissf_id": "D6-CTL-06",
      "gaissf_title": "Third-Party Ai Vendor Governance",
      "domain": "D6",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0079",
      "gaissf_id": "D6-CTL-07",
      "gaissf_title": "Ai Resilience & Business Continuity",
      "domain": "D6",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0080",
      "gaissf_id": "D7-CTL-H01",
      "gaissf_title": "Ai-Generated Phishing Simulation",
      "domain": "D7",
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0081",
      "gaissf_id": "D7-CTL-H01",
      "gaissf_title": "Ai-Generated Phishing Simulation",
      "domain": "D7",
      "article": 30,
      "article_title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0082",
      "gaissf_id": "D7-CTL-H02",
      "gaissf_title": "Deepfake Detection Training",
      "domain": "D7",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0083",
      "gaissf_id": "D7-CTL-H03",
      "gaissf_title": "Out-Of-Band Authentication",
      "domain": "D7",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0084",
      "gaissf_id": "D7-CTL-H04",
      "gaissf_title": "Ai Social Engineering Ir",
      "domain": "D7",
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "High",
      "rationale": "Supports incident detection, evidence capture, escalation and reporting workflows, but does not by itself satisfy statutory notification timing and content.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0085",
      "gaissf_id": "D7-CTL-H05",
      "gaissf_title": "Ai-Enhanced External Attack Defense",
      "domain": "D7",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0086",
      "gaissf_id": "D7-CTL-H05",
      "gaissf_title": "Ai-Enhanced External Attack Defense",
      "domain": "D7",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0087",
      "gaissf_id": "D7-CTL-H05",
      "gaissf_title": "Ai-Enhanced External Attack Defense",
      "domain": "D7",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0088",
      "gaissf_id": "D7-CTL-H05",
      "gaissf_title": "Ai-Enhanced External Attack Defense",
      "domain": "D7",
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0089",
      "gaissf_id": "D8-CTL-01",
      "gaissf_title": "Eu Ai Act Risk Tier Mapping",
      "domain": "D8",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0090",
      "gaissf_id": "D8-CTL-01",
      "gaissf_title": "Eu Ai Act Risk Tier Mapping",
      "domain": "D8",
      "article": 7,
      "article_title": "National cybersecurity strategy",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "relationship": "C",
      "coverage": "Indirectly Supported",
      "confidence": "Low",
      "rationale": "Can inform organisational alignment with national cybersecurity strategies but does not implement Member State duties.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0091",
      "gaissf_id": "D8-CTL-02",
      "gaissf_title": "Iso 42001 Gap Analysis",
      "domain": "D8",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0092",
      "gaissf_id": "D8-CTL-02",
      "gaissf_title": "Iso 42001 Gap Analysis",
      "domain": "D8",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0093",
      "gaissf_id": "D8-CTL-02",
      "gaissf_title": "Iso 42001 Gap Analysis",
      "domain": "D8",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0094",
      "gaissf_id": "D8-CTL-02",
      "gaissf_title": "Iso 42001 Gap Analysis",
      "domain": "D8",
      "article": 7,
      "article_title": "National cybersecurity strategy",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "relationship": "C",
      "coverage": "Indirectly Supported",
      "confidence": "Low",
      "rationale": "Can inform organisational alignment with national cybersecurity strategies but does not implement Member State duties.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0095",
      "gaissf_id": "D8-CTL-03",
      "gaissf_title": "Gpai Technical Documentation Verification",
      "domain": "D8",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0096",
      "gaissf_id": "D8-CTL-03",
      "gaissf_title": "Gpai Technical Documentation Verification",
      "domain": "D8",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0097",
      "gaissf_id": "D8-CTL-03",
      "gaissf_title": "Gpai Technical Documentation Verification",
      "domain": "D8",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0098",
      "gaissf_id": "D8-CTL-03",
      "gaissf_title": "Gpai Technical Documentation Verification",
      "domain": "D8",
      "article": 33,
      "article_title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0099",
      "gaissf_id": "D8-CTL-04",
      "gaissf_title": "Dora Ict Incident Reporting (Financial Sector)",
      "domain": "D8",
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "High",
      "rationale": "Supports incident detection, evidence capture, escalation and reporting workflows, but does not by itself satisfy statutory notification timing and content.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0100",
      "gaissf_id": "D8-CTL-05",
      "gaissf_title": "Nist Sp 800-218A Compliance Check",
      "domain": "D8",
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Supports management oversight, accountability and documented approval of cybersecurity measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0101",
      "gaissf_id": "D8-CTL-05",
      "gaissf_title": "Nist Sp 800-218A Compliance Check",
      "domain": "D8",
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0102",
      "gaissf_id": "D8-CTL-05",
      "gaissf_title": "Nist Sp 800-218A Compliance Check",
      "domain": "D8",
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "May support use of certification, standards and technical specifications contemplated by NIS2.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0103",
      "gaissf_id": "D8-CTL-05",
      "gaissf_title": "Nist Sp 800-218A Compliance Check",
      "domain": "D8",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0104",
      "gaissf_id": "D9-CTL-01",
      "gaissf_title": "Physical Harm Boundary Enforcement",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "The control contributes to an all-hazards cybersecurity risk-management capability, subject to entity and system scope.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0105",
      "gaissf_id": "D9-CTL-02",
      "gaissf_title": "Safe State And Graceful Degradation",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0106",
      "gaissf_id": "D9-CTL-03",
      "gaissf_title": "Human Override And Emergency Stop",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0107",
      "gaissf_id": "D9-CTL-04",
      "gaissf_title": "Cyber-Physical Attack Detection",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0108",
      "gaissf_id": "D9-CTL-04",
      "gaissf_title": "Cyber-Physical Attack Detection",
      "domain": "D9",
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0109",
      "gaissf_id": "D9-CTL-04",
      "gaissf_title": "Cyber-Physical Attack Detection",
      "domain": "D9",
      "article": 30,
      "article_title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "S",
      "coverage": "Indirectly Supported",
      "confidence": "Medium",
      "rationale": "Supports structured sharing or voluntary notification of cyber-threat and incident information.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0110",
      "gaissf_id": "D9-CTL-05",
      "gaissf_title": "Physical Environment Integrity Monitoring",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0111",
      "gaissf_id": "D9-CTL-06",
      "gaissf_title": "Actuator Command Verification",
      "domain": "D9",
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "SP",
      "coverage": "Substantially Addressed",
      "confidence": "High",
      "rationale": "Provides a technical, operational or organisational safeguard relevant to NIS2 risk-management measures.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0112",
      "gaissf_id": "D9-CTL-07",
      "gaissf_title": "Physical Incident Evidence Preservation",
      "domain": "D9",
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "High",
      "rationale": "Supports incident detection, evidence capture, escalation and reporting workflows, but does not by itself satisfy statutory notification timing and content.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0113",
      "gaissf_id": "D9-CTL-07",
      "gaissf_title": "Physical Incident Evidence Preservation",
      "domain": "D9",
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0114",
      "gaissf_id": "D9-CTL-07",
      "gaissf_title": "Physical Incident Evidence Preservation",
      "domain": "D9",
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    },
    {
      "record_id": "GAISSF-CRO-029-MAP-0115",
      "gaissf_id": "D9-CTL-07",
      "gaissf_title": "Physical Incident Evidence Preservation",
      "domain": "D9",
      "article": 33,
      "article_title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "relationship": "P",
      "coverage": "Partially Addressed",
      "confidence": "Medium",
      "rationale": "Produces evidence that may support supervisory review, inspection or remediation, subject to national law.",
      "residual_gap": "NIS2 and national-law applicability, jurisdiction, essential/important entity classification, proportionality, Member State transposition, competent-authority procedures, statutory reporting timing/content, evidence sufficiency and operating effectiveness require separate verification.",
      "gaissf_source": "GAISSF-NOR-004 v1.0",
      "nis2_source": "Directive (EU) 2022/2555"
    }
  ],
  "reverse": [
    {
      "article": 1,
      "article_title": "Subject matter",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 2,
      "article_title": "Scope",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 3,
      "article_title": "Essential and important entities",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 4,
      "article_title": "Sector-specific Union legal acts",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 5,
      "article_title": "Minimum harmonisation",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 6,
      "article_title": "Definitions",
      "chapter": "Chapter I — General provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 7,
      "article_title": "National cybersecurity strategy",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [
        "D8-CTL-01",
        "D8-CTL-02"
      ],
      "mapped_count": 2,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 8,
      "article_title": "Competent authorities and single points of contact",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 9,
      "article_title": "National cyber crisis management frameworks",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 10,
      "article_title": "Computer security incident response teams (CSIRTs)",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 11,
      "article_title": "Requirements, technical capabilities and tasks of CSIRTs",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 12,
      "article_title": "Cooperation at national level",
      "chapter": "Chapter II — Coordinated cybersecurity frameworks",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 13,
      "article_title": "Cooperation Group",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 14,
      "article_title": "CSIRTs network",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 15,
      "article_title": "European cyber crisis liaison organisation network (EU-CyCLONe)",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 16,
      "article_title": "Report on the state of cybersecurity in the Union",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 17,
      "article_title": "Peer reviews",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 18,
      "article_title": "Mutual assistance",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 19,
      "article_title": "Union-level coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter III — Cooperation",
      "mapped_controls": [
        "D3-CTL-07",
        "D4-CTL-01",
        "D4-CTL-03"
      ],
      "mapped_count": 3,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 20,
      "article_title": "Governance",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D4-CTL-06",
        "D5-CTL-06",
        "D6-CTL-01",
        "D6-CTL-02",
        "D6-CTL-03",
        "D6-CTL-06",
        "D7-CTL-H05",
        "D8-CTL-01",
        "D8-CTL-02",
        "D8-CTL-05"
      ],
      "mapped_count": 10,
      "coverage_status": "Substantially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 21,
      "article_title": "Cybersecurity risk-management measures",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D1-CTL-01",
        "D1-CTL-02",
        "D1-CTL-03",
        "D1-CTL-04",
        "D1-CTL-05",
        "D1-CTL-06",
        "D1-CTL-07",
        "D1-CTL-08",
        "D1-CTL-09",
        "D2-CTL-01",
        "D2-CTL-02",
        "D2-CTL-03",
        "D2-CTL-04",
        "D2-CTL-05",
        "D2-CTL-06",
        "D3-CTL-01",
        "D3-CTL-02",
        "D3-CTL-03",
        "D3-CTL-04",
        "D3-CTL-05",
        "D3-CTL-06",
        "D3-CTL-07",
        "D4-CTL-01",
        "D4-CTL-02",
        "D4-CTL-03",
        "D4-CTL-04",
        "D4-CTL-05",
        "D4-CTL-07",
        "D5-CTL-01",
        "D5-CTL-02",
        "D5-CTL-03",
        "D5-CTL-04",
        "D5-CTL-05",
        "D5-CTL-06",
        "D6-CTL-04",
        "D6-CTL-05",
        "D6-CTL-06",
        "D6-CTL-07",
        "D7-CTL-H02",
        "D7-CTL-H03",
        "D8-CTL-03",
        "D9-CTL-01",
        "D9-CTL-02",
        "D9-CTL-03",
        "D9-CTL-04",
        "D9-CTL-05",
        "D9-CTL-06"
      ],
      "mapped_count": 47,
      "coverage_status": "Substantially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 22,
      "article_title": "Coordinated security risk assessments of critical supply chains",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D3-CTL-07",
        "D4-CTL-01",
        "D4-CTL-03",
        "D4-CTL-04",
        "D4-CTL-05",
        "D4-CTL-07",
        "D6-CTL-06"
      ],
      "mapped_count": 7,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 23,
      "article_title": "Reporting obligations",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D6-CTL-02",
        "D6-CTL-04",
        "D7-CTL-H04",
        "D8-CTL-04",
        "D9-CTL-07"
      ],
      "mapped_count": 5,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 24,
      "article_title": "Use of European cybersecurity certification schemes",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D1-CTL-01",
        "D1-CTL-04",
        "D1-CTL-06",
        "D7-CTL-H05",
        "D8-CTL-02",
        "D8-CTL-05"
      ],
      "mapped_count": 6,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 25,
      "article_title": "Standardisation",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D1-CTL-01",
        "D1-CTL-04",
        "D1-CTL-06",
        "D7-CTL-H05",
        "D8-CTL-02",
        "D8-CTL-05"
      ],
      "mapped_count": 6,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 26,
      "article_title": "Jurisdiction and territoriality",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 27,
      "article_title": "Registry of entities",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 28,
      "article_title": "Domain name registration data",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Not Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 29,
      "article_title": "Cybersecurity information-sharing arrangements",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D1-CTL-08",
        "D6-CTL-04",
        "D7-CTL-H01",
        "D7-CTL-H05",
        "D9-CTL-04"
      ],
      "mapped_count": 5,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 30,
      "article_title": "Voluntary notification of relevant information",
      "chapter": "Chapter IV — Risk management and reporting",
      "mapped_controls": [
        "D1-CTL-08",
        "D6-CTL-04",
        "D7-CTL-H01",
        "D9-CTL-04"
      ],
      "mapped_count": 4,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 31,
      "article_title": "General aspects concerning supervision and enforcement",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [
        "D4-CTL-05",
        "D4-CTL-06",
        "D5-CTL-06",
        "D6-CTL-02",
        "D6-CTL-03",
        "D6-CTL-06",
        "D8-CTL-03",
        "D8-CTL-05",
        "D9-CTL-07"
      ],
      "mapped_count": 9,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 32,
      "article_title": "Supervisory and enforcement measures in relation to essential entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [
        "D4-CTL-05",
        "D4-CTL-06",
        "D5-CTL-06",
        "D6-CTL-02",
        "D6-CTL-03",
        "D8-CTL-03",
        "D9-CTL-07"
      ],
      "mapped_count": 7,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 33,
      "article_title": "Supervisory and enforcement measures in relation to important entities",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [
        "D4-CTL-06",
        "D6-CTL-03",
        "D8-CTL-03",
        "D9-CTL-07"
      ],
      "mapped_count": 4,
      "coverage_status": "Partially Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 34,
      "article_title": "General conditions for imposing administrative fines",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Not Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 35,
      "article_title": "Infringements entailing a personal data breach",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Not Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 36,
      "article_title": "Penalties",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Not Addressed",
      "residual_gap": "GAISSF may provide implementation or evidence support, but legal applicability, Member State transposition, entity classification, competent-authority procedures, statutory deadlines/content, evidence sufficiency and operating effectiveness remain separate."
    },
    {
      "article": 37,
      "article_title": "Delegation of power",
      "chapter": "Chapter VII — Supervision and enforcement",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 38,
      "article_title": "Exercise of the delegation",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 39,
      "article_title": "Committee procedure",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 40,
      "article_title": "Review",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 41,
      "article_title": "Transposition",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 42,
      "article_title": "Amendment of Regulation (EU) No 910/2014",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 43,
      "article_title": "Amendment of Directive (EU) 2018/1972",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 44,
      "article_title": "Repeal",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 45,
      "article_title": "Entry into force",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    },
    {
      "article": 46,
      "article_title": "Addressees",
      "chapter": "Chapter VIII — Delegated, implementing and final provisions",
      "mapped_controls": [],
      "mapped_count": 0,
      "coverage_status": "Outside Scope",
      "residual_gap": "This provision primarily concerns legal scope, Member States, EU cooperation, jurisdiction, supervision, enforcement or procedure and is not established by GAISSF controls."
    }
  ],
  "notably_absent": [
    "No automatic NIS2 or national-law compliance claim.",
    "No determination that an organisation is an essential or important entity.",
    "No country-specific transposition or competent-authority procedure analysis.",
    "No European Commission, ENISA, Member State authority or regulator endorsement.",
    "No evidence-sufficiency or operating-effectiveness finding.",
    "No automatic satisfaction of Article 23 or national incident-notification deadlines and content requirements.",
    "No automatic applicability of Commission Implementing Regulation (EU) 2024/2690 without entity-class analysis.",
    "No automatic conformance, certification credit, or legal safe harbour."
  ]
}