Jurisdiction normally follows establishment, but several categories of provider are treated differently and the entity has to work out which rule applies to it. Providers of public electronic communications networks or publicly available electronic communications services fall under each Member State in which they provide services. DNS service providers, TLD name registries, domain name registration service providers, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, and providers of online marketplaces, online search engines and social networking platforms fall under the Member State of their main establishment, defined as where decisions on cybersecurity risk-management measures are predominantly taken, failing which where cybersecurity operations are carried out, failing which where the largest Union workforce sits. An entity in that second group which is not established in the Union but offers services there must designate a representative established in a Member State where it offers services, and falls under that Member State's jurisdiction. Without a designated representative any Member State where it provides services may act against it.
This control maps to 8 controls across 6 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
NIS2 Directive Art.26 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 8 it maps to, and the evidence behind each claim, over MCP and REST.