The European Commission issued 19 reasoned opinions in April 2026 identifying member states with NIS2 transposition gaps. ENISA's NCAF 2.0 provides the benchmarking framework against which those gaps are now formally assessed.Source: European Commission / ENISA April 2026

What is ENISA's National Capabilities Assessment Framework and why does it matter?

NCAF 2.0, published by ENISA on 22 April 2026, is a structured framework for EU member states to benchmark their national cybersecurity maturity against NIS2 obligations. It was released alongside the European Commission's 19 reasoned opinions on member states that have not fully transposed NIS2 into national law.Source: ENISA / European Commission, April 2026

What is ENISA and what does it regulate?

ENISA is the EU Agency for Cybersecurity, responsible for cybersecurity certification schemes, threat landscape reports and technical guidance to the European Commission on NIS2 and CRA implementation. It opened a consultation on EU Digital Identity Wallet certification in April 2026 and published the NCAF 2.0 NIS2 maturity framework on 22 April 2026.Source: ENISA

Background

The European Union Agency for Cybersecurity (ENISA) is the EU's central cybersecurity agency, responsible for developing cybersecurity certification schemes, threat-landscape assessments and supporting member-state CERTs. It publishes the annual ENISA Threat Landscape report, manages the EU cybersecurity certification framework under the Cybersecurity Act, and provides technical guidance to the European Commission on NIS2 and CRA implementation. It was established in 2004 and given a permanent, strengthened mandate under the Cybersecurity Act in 2019.

ENISA opened a public consultation on a draft EU Digital Identity Wallet certification scheme on 3 April 2026, a significant milestone in establishing security-assurance requirements for wallet implementations under eIDAS2. The certification scheme defines how the EU Digital Wallet intersects with the Cyber Resilience Act (CRA) product-security requirements that apply from 11 December 2027. On 22 April 2026, ENISA published the National Capabilities Assessment Framework v2 (NCAF 2.0), a structured member-state benchmarking tool for NIS2 maturity, alongside the European Commission's 19 reasoned opinions identifying transposition gaps.

On 28 May 2026, ENISA published the third annual NIS360 report. Three sectors crossed into the risk zone for the first time: railway, drinking water and waste water — placed there because their criticality now exceeds their assessed security maturity. One in three water-sector entities has never carried out a risk assessment, giving regulators a documented maturity gap to enforce against under NIS2. Around half of public administrations give management no cybersecurity training at all, and 63 per cent of all hacktivist attacks target that tier. Three sectors reached high maturity for the first time: trust services, aviation and financial market infrastructures. NIS360 extends NCAF 2.0's member-state scoring to sector-level exposure, completing ENISA's two-track accountability architecture for the current NIS2 enforcement cycle.

For technology vendors building EU Digital Identity Wallet infrastructure, ENISA's certification consultation is the primary technical-standard input. The NCAF 2.0 and NIS360 releases together give national regulators both a member-state maturity score and a sector-level risk map to anchor enforcement decisions.

ENISA's threat-landscape and sector-risk work covers Energy infrastructure, including oil and gas. Its annual threat landscape reports document adversary tactics against European energy operators, and the NIS2 framework it supports applies to energy as an essential sector.