Participation in a cybersecurity information-sharing arrangement is voluntary, but telling the regulator about it is not. An entity that enters into such an arrangement must notify the competent authority on entry, and must notify it again on withdrawal once the withdrawal takes effect. The obligation is small and easy to miss precisely because the arrangement itself is optional, and it usually sits with the threat intelligence team rather than with whoever handles regulatory correspondence. Sector information sharing and analysis centres, trusted communities and bilateral exchanges with suppliers can all fall within scope, so the practical requirement is a maintained inventory of arrangements with a notification state against each.
NIS2 Directive Art.29.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.