Article 29 establishes the COMMON ELECTRICITY CYBERSECURITY FRAMEWORK - a sector-specific set of cybersecurity controls building on horizontal frameworks (NIS2 Article 21(2) + ISO/IEC 27001 + IEC 62443) but adapted to the electricity sector + cross-border flows + OT (operational technology) systems. Article 30 sets the MINIMUM CYBERSECURITY CONTROLS that all high-impact entities must implement, covering: (a) cybersecurity governance + organisational structure including a dedicated CISO function; (b) information security policy + standards; (c) risk management + asset management + change management; (d) human resources security + cybersecurity training; (e) identity + access management + privileged-access management; (f) cryptography + key management; (g) physical + environmental security; (h) communications + operations security; (i) supplier + supply-chain security; (j) incident management + business continuity; (k) audit + assurance + compliance monitoring. Article 31 establishes the implementation timeline: minimum controls must be in place within 24 months of entity-classification + reviewed + revised at least annually.
This control maps to 4 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.