ENISA Guidance Explained: which ENISA outputs practitioners should actually use

ENISA publishes a lot, but only a handful of its outputs change what a security team does on Monday morning: the NIS2 Technical Implementation Guidance and its mapping table, the Cyber Resilience Act reporting platform, and a run of 2026 product security advisories aimed at smaller manufacturers. Most of the rest is written for national authorities and policy makers, and is useful as context rather than as a control set. This guide sorts ENISA's current outputs by job: what each one is, who it is written for, when to use it, and which NHI Mgmt Group guide goes deeper. It is for CISOs, GRC leads, product security teams and auditors in organisations subject to NIS2 or the CRA. It does not repeat the detail in the NIS2 Implementing Regulation 2024/2690 Guide or the ENISA Threat Landscape Guide; it points you to them.

Status checked 9 November 2026 against ENISA's publications listing and the individual publication pages. ENISA adds items often, so check the listing for anything newer than the dates below.

Key takeaways

• Start with the audience tag: ENISA labels each publication for national and EU authorities, the private sector, or both. Private-sector items are the ones written to be applied.
• The NIS2 guidance is sector-specific: the Technical Implementation Guidance (June 2025) covers the digital infrastructure, ICT service management and digital provider entities under Implementing Regulation 2024/2690, not every NIS2 entity, though others can borrow from it.
• The mapping table moves faster than the report: the main guidance is version 1.0; the companion mapping spreadsheet was at version 1.2 in September 2025.
• The CRA platform is operational: ENISA's Single Reporting Platform went live on 11 September 2026 for manufacturers' Article 14 reports.
• 2026 product security outputs target SMEs: the SBOM advisory, secure update advisory, Secure by Design and Default Playbook and SME maturity model give smaller manufacturers practical steps.

How to read ENISA outputs

ENISA is the EU Agency for Cybersecurity. Its outputs fall into three groups for practitioners:

• Implementation guidance: written to help entities meet a legal requirement. Use these as working documents.
• Operational services: platforms and databases ENISA runs, such as the CRA reporting platform and the EU Vulnerability Database. Use these as part of a process.
• Situational reports: threat landscapes and sector maturity reports. Use these for risk context, board briefings and benchmarking, not as a control list.

Each publication page shows the date, version, audience and topic. Record the version you used in your evidence, because ENISA updates companion files separately from the main report.

ENISA outputs at a glance

If you are a NIS2 entity

The Technical Implementation Guidance

ENISA describes this report as practical advice, examples of evidence and mappings of security requirements, to help companies implement Commission Implementing Regulation (EU) 2024/2690. It covers entity types in the digital infrastructure, ICT service management and digital provider sectors, such as DNS, cloud, data centre and managed service providers. Several national authorities point digital providers to it; Denmark's Agency for Digital Government does so on its requirements page, for example (see the Denmark NIS2 Implementation Guide).

• If you are in those sectors: use the evidence examples to build your audit pack, and record the guidance version and mapping table version you used.
• If you are in another sector: the guidance is still a reasonable benchmark for what "appropriate and proportionate" can look like, but your national law and supervisor set the test. Check your country page, for example the Finland NIS2 Implementation Guide or the Austria NIS2 Implementation Guide.
• Mapping table: the spreadsheet links requirements to standards and frameworks, which helps if you already run ISO/IEC 27001 or another framework. Use it to avoid duplicate control work.

Roles and skills

ENISA published a companion report on cybersecurity roles and skills for NIS2 entities in June 2025, mapping NIS2 obligations to the European Cybersecurity Skills Framework. Use it to show supervisors that named people hold the duties the measures assume, and to plan management training under Article 20.

NIS360

NIS360 assesses the cybersecurity maturity and criticality of the high-criticality sectors in NIS2 Annex I, looking at each sector's whole ecosystem: national authorities, entities, EU bodies and the applicable legislation. The third edition was published on 28 May 2026, and ENISA's summary says maturity has improved while criticality has stayed comparatively stable. It is written for authorities, so use it for context: where your sector sits, and why your supervisor may focus on particular gaps.

If you make products with digital elements

The CRA Single Reporting Platform

ENISA's FAQ describes the platform as the single place where manufacturers report actively exploited vulnerabilities and severe incidents, once, instead of notifying each national authority. It became operational on 11 September 2026, when Article 14 reporting began. Points from the FAQ that affect identity and access:

• Assigned Representatives: manufacturers act through one Primary and up to 20 Secondary Assigned Representatives, each with an EU Login account using multi-factor authentication.
• No API at present: as of November 2026 the FAQ says reporting is through the web interface, in English. Plan human cover rather than an automated submission.
• Stages: early warning within 24 hours, notification within 72 hours, and a final report 14 days after a fix for exploited vulnerabilities or one month after the notification for severe incidents.
• Open-source stewards: their obligations start on 11 December 2027.

Treat the Assigned Representative accounts as privileged identities: name them, keep deputies, and remove access when people leave. The full process is in the EU Cyber Resilience Act Vulnerability and Incident Reporting Guide.

The 2026 product security set

• SBOM technical advisory (22 October 2026): covers SBOM implementation architecture and data flows across a lifecycle, an indicative SBOM threat model, and measures for the SBOM ecosystem. Aimed at SMEs and stewards setting up a first capability. Pair it with the SBOM operations guide.
• Secure update mechanisms advisory (4 November 2026): covers threats across the update life cycle and mitigating controls. Update signing keys and the pipeline identities that publish updates are among the most sensitive non-human identities a manufacturer holds.
• Secure by Design and Default Playbook (30 July 2026): step-by-step guidance meant to fit existing engineering and release processes, with a companion GitHub repository holding 22 playbooks.
• SME Cyber Resilience Maturity Assessment Model (13 July 2026): a structured self-assessment with a CRA maturity model spreadsheet tool, for manufacturers and for integrators and service providers in the product life cycle.

If you buy or run critical services

• Hospital procurement guidelines (22 July 2026): cover every stage of the procurement lifecycle, the requirements buyers should set and the information suppliers must provide, aligned with NIS2, medical device rules, the GDPR and the European health data space regulation. Use them to write supplier access and credential requirements into contracts.
• Threat Landscape 2026 (22 September 2026): reviews incidents from 1 January to 31 December 2025. Use the ENISA Threat Landscape Guide for how to turn it into risk scenarios.
• Frontier AI view (7 July 2026): an initial, non-exhaustive set of recommendations on building capabilities for machine-speed threats, to be refined with Member States and aligned with a forthcoming Commission action plan. Track it if you run AI agents in production.

For vulnerability intelligence, ENISA's EU Vulnerability Database is covered in the EU Vulnerability Database (EUVD) guide, and EU certification schemes in the EU Cybersecurity Certification EUCC Guide and EU Cybersecurity Act and EUCS Guide.

Where non-human identities fit

None of these outputs is an NHI standard, but several reach machine identities directly:

• Access control evidence: the Implementing Regulation's access control and authentication requirements, and ENISA's evidence examples for them, apply to service accounts, API keys and workload identities as much as to staff.
• Update and build pipelines: the secure update advisory and SBOM advisory concern systems that run under pipeline tokens and signing keys. Inventory and protect those credentials.
• Reporting accounts: CRA Assigned Representatives and national portal users are high-value human identities that gate legal deadlines.
• AI agents: the frontier AI recommendations are early, so apply existing controls now: a distinct identity per agent, narrow scopes and logging. See the Non-Human Identity (NHI) Guide.

Common failure patterns

• Treating authority reports as control sets: NIS360 and the threat landscape inform risk, they do not define your measures.
• Outdated companion files: using an early mapping table when a later version exists.
• Assuming the NIS2 guidance applies to every sector: it targets the 2024/2690 entity types; your national rules govern the rest.
• One reporting user: a single Assigned Representative on leave when a 24-hour CRA clock starts.
• Ignoring signing keys: update and SBOM work that leaves the keys and tokens behind the pipeline out of scope.

Practitioner checklist

• Check ENISA's publications listing quarterly and record new items relevant to you.
• Record the version of the Technical Implementation Guidance and mapping table used in evidence.
• Decide whether the NIS2 guidance applies directly or as a benchmark for your sector.
• Name a Primary and Secondary Assigned Representatives for the CRA platform, with MFA.
• Map update signing keys and pipeline tokens against the secure update advisory.
• Run the SME maturity model if you are a smaller manufacturer.
• Use the roles and skills report to assign NIS2 duties and plan training.
• Brief leadership with NIS360 and the threat landscape as context, not as control lists.

Standards and references

• ENISA: Publications
• ENISA: NIS2 Technical Implementation Guidance
• ENISA: NIS360 (third edition)
• ENISA: CRA Single Reporting Platform FAQ
• ENISA: Technical Advisory for Software Bill of Materials
• ENISA: Technical Advisory on Secure Update Mechanisms
• ENISA: Secure by Design and Default Playbook
• ENISA: SME Cyber Resilience Maturity Assessment Model
• ENISA: Procurement guidelines for the cybersecurity of hospitals and healthcare providers
• ENISA: ENISA's view on cybersecurity in the frontier AI era
• Agency for Digital Government (Denmark): What are the requirements?

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Implementing Regulation 2024/2690 Guide · ENISA Threat Landscape Guide · EU Cyber Resilience Act Guide · Non-Human Identity (NHI) Guide. This guide reflects ENISA publications available on 9 November 2026.