--- title: How Does Continuous Controls Validation Work For NIS2 (CyFun)? description: "Continuous Controls Validation: NIS2 (CyFun) maps your validated vulnerability findings against the CyberFundamentals (CyFun) framework used to demonstrate NIS2 compliance, organized by NIST CSF function and linked directly to the relevant NIS2 Article 21(2) measures." --- [Skip to content](https://kb.edgescan.com/knowledge/what-is-the-edgescan-nis2-cyfun#main-content) English Show submenu for translations [![Edgescan Cybersecurity Platform | EASM + RBVM + PTaaS](https://kb.edgescan.com/hs-fs/hubfs/Logos/23LOGOS-thicker/Edgescan-Logo-Black.png?width=200&height=40&name=Edgescan-Logo-Black.png)](https://www.edgescan.com/) Open main navigation Close main navigation - English Show submenu for translations Search the Edgescan knowledge base - There are no suggestions because the search field is empty. 1. [Help Center](https://kb.edgescan.com/knowledge?hsLang=en) 2. [Platform Usage](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en) 3. [AI Insights](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#ai-insights) # How Does Continuous Controls Validation Work For NIS2 (CyFun)? ## Continuous Controls Validation: NIS2 (CyFun) maps your validated vulnerability findings against the CyberFundamentals (CyFun) framework used to demonstrate NIS2 compliance, organized by NIST CSF function and linked directly to the relevant NIS2 Article 21(2) measures. Version Number: v1.0.0 Published Date: 27 Aug 2026 \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ ### What is it? This report constitutes **evidence-based control validation** using validated Edgescan findings. It does **not** constitute a formal CyFun certification audit or an official NIS2 conformity determination. Control applicability depends on your organization's designated CyFun assurance level (Basic, Important, or Essential) and your NIS2 entity classification (Essential or Important Entity). ### How it works? - **NIST CSF Function Breakdown** - Current control violations are grouped by NIST CSF function, Protect, Identify, Detect, and Respond,  giving an at-a-glance view of where weaknesses are concentrated. - **Control-by-Control Detail** - Each affected CyFun control (for example PR.IP-12 Vulnerability Management Plan, PR.AC-3 Remote Access Management, PR.DS-1/2 Data-at-Rest and Data-in-Transit Protection, PR.AC-4 Access Permissions, PR.PT-3 Least Functionality, PR.IP-1 Baseline Configuration, DE.CM-8 Vulnerability Scans) is presented with its control intent and lowest applicable CyFun assurance level. - **Current Violations & Avoided Non-Compliances** - Each control lists the specific open findings evidencing a violation, plus any previously remediated findings that avoided a violation. - **NIS2 Article 21(2) Mapping** - Every control is explicitly linked to the specific NIS2 Article 21(2) measure(s) it supports,  for example Article 21(2)(e) security in acquisition, development and maintenance, or Article 21(2)(i) multi-factor authentication and secured communications. - **Remediation Guidance** - Each control section closes with prioritized remediation steps addressing the specific violations found. ### Features & Benefits - **Regulation-Linked:** Ties technical findings directly to the specific legal measures they support or violate, not just a generic framework. - **Assurance-Level Aware:** Flags the minimum CyFun assurance level each control applies at, so effort can be targeted appropriately. - **Evidence, Not Assertion:** Every violation and every avoided non-compliance is backed by a real, validated finding. - **Regulatory Reporting Ready:** Structured to support NIS2-related reporting obligations and internal governance reviews. ### Common Use-Cases - **NIS2 Compliance Programmes:** Provide ongoing evidence of control status ahead of formal NIS2 conformity assessment. - **Regulatory Reporting:** Support internal or external reporting on NIS2 Article 21(2) measures. - **Gap Analysis:** Identify which CyFun controls have the most outstanding violations and prioritize remediation accordingly. - **Board & Regulator-Facing Summaries:** Present cybersecurity risk management posture in terms directly aligned to NIS2 obligations. - [Getting Started](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#main-content) - [Quick Start](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#quick-start) - [Prerequisites & Network Requirements](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#prerequisites-network-requirements) - [Compliance Context](https://kb.edgescan.com/knowledge/getting-started?hsLang=en#compliance-context) - [Attack Surface Management](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#main-content) - [Concepts](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#concepts) - [Discovery Methods](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#discovery-methods) - [Asset Inventory](https://kb.edgescan.com/knowledge/attack-surface-management?hsLang=en#asset-inventory) - [Vulnerability Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#main-content) - [Enabling & Disabling Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#enabling-disabling-scanning) - [Scope & Targeting](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#scope-targeting) - [Setting Authentication](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#setting-authentication) - [DAST Scanning](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#dast-scanning) - [API Settings](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#api-settings) - [Scanning Complex Workflows](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#scanning-complex-workflows) - [Vulnerability Risk Ratings](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#vulnerability-risk-ratings) - [Additional Configurations](https://kb.edgescan.com/knowledge/vulnerability-scanning?hsLang=en#additional-configurations) - [Agentic PTaaS](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#main-content) - [Overviews and Concepts](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#overviews-and-concepts) - [Using Atomic](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#using-atomic) - [Safety and Privacy](https://kb.edgescan.com/knowledge/agentic-ptaas?hsLang=en#safety-and-privacy) - [Human PTaaS](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#main-content) - [Concepts & Methodologies](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#concepts-methodologies) - [Scheduling PTaaS](https://kb.edgescan.com/knowledge/human-ptaas?hsLang=en#scheduling-ptaas) - [Platform Usage](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#main-content) - [Platform Navigation](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#platform-navigation) - [Managing Assets](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#managing-assets) - [Managing Vulnerabilities](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#managing-vulnerabilities) - [Managing Licenses](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#managing-licenses) - [Managing Credentials](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#managing-credentials) - [Asset Blockers](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#asset-blockers) - [Reporting & Dashboards](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#reporting-dashboards) - [AI Insights](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#ai-insights) - [Compliance & Frameworks](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#compliance-frameworks) - [Additional License Details](https://kb.edgescan.com/knowledge/platform-usage?hsLang=en#additional-license-details) - [Platform Automation](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#main-content) - [Notifications & Events](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#notifications-events) - [Internal/Private Testing](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#internal-private-testing) - [API & Authentication](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#api-authentication) - [Scheduled Exports](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#scheduled-exports) - [Cloud Platforms](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#cloud-platforms) - [CloudHook](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#cloudhook) - [ITSM & Ticketing](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#itsm-ticketing) - [SIEM & SOAR](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#siem-soar) - [CI/CD & DevOps](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#ci-cd-devops) - [Communication Automation](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#communication-automation) - [Other Automations](https://kb.edgescan.com/knowledge/platform-automation?hsLang=en#other-automations) - [Organization Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#main-content) - [Organization Setup](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#organization-setup) - [User Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#user-administration) - [Roles Administration](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#roles-administration) - [Account Settings](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#account-settings) - [Organization Settings](https://kb.edgescan.com/knowledge/organization-administration?hsLang=en#organization-settings) - [Updates & Announcements](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#main-content) - [2026 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2026-updates) - [2025 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2025-updates) - [2024 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2024-updates) - [2023 Updates](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#2023-updates) - [API Changes](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#api-changes) - [OWASP API 2019](https://kb.edgescan.com/knowledge/updates-announcements?hsLang=en#owasp-api-2019) [![Chill listening crop-3](https://kb.edgescan.com/hs-fs/hubfs/Edgescan-blac-logo.webp?width=68&height=55&name=Edgescan-blac-logo.webp "Chill listening crop-3")](https://www.edgescan.com) Copyright © 2026 Edgescan. All rights reserved.