All frameworks EU

EU Digital Operational Resilience Act (Regulation (EU) 2022/2554)

Binding EU regulation for financial entities, applicable since 17 January 2025. Article 9 requires strong authentication for remote and privileged access and protection of data at rest, in use, and in transit. Detailed requirements are set by the ICT risk management RTS, Commission Delegated Regulation (EU) 2024/1774.

EU banks, insurers, investment firms, crypto-asset providers, and their ICT suppliers

10

control domains mapped

46

products applicable

11

other frameworks cross-mapped

EU Digital Operational Resilience Act (Regulation (EU) 2022/2554)

Art. 9(4)(d) Policies and protocols for strong authentication mechanisms, based on leading standards

Phishing-resistant MFA using hardware security keys. Software TOTP and SMS are explicitly excluded from "phishing-resistant" in NIST 800-63B and most modern framework guidance.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Amazon affiliate YubiKey Developer board Nitrokey 3A NFC Hacker $100

Same control in other frameworks:

NIST 800-53 IA-2(6) NIST CSF 2.0 PR.AA-03 ISO 27001 A.8.5 SOC 2 CC6.1 NIS2 Art.21(2)(i) CMMC 2.0 IA.L2-3.5.3 CIS Controls v8 CIS-6.3 PCI DSS 4.0.1 8.4.2 HIPAA Security Rule §164.312(d) Essential Eight E8-MFA Cyber Essentials CE-4

Art. 9(4)(d) Measures for protecting encryption keys by which data is encrypted

Hardware-bound key generation and storage. Private keys generated and stored inside a certified secure element (EAL 6+) and are non-exportable by design — for login credentials (Nitrokey) and crypto-asset custody (Ledger) alike.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardware wallet Ledger Stax $399 Hardware wallet Ledger Flex $249 Hardware wallet Ledger Nano Gen5 $179 Hardware wallet Ledger Nano X $99 Hardware wallet Ledger Nano S Plus $59 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Amazon affiliate YubiKey

Same control in other frameworks:

NIST 800-53 SC-12 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.10 CIS Controls v8 CIS-3.11 PCI DSS 4.0.1 3.7.1 HIPAA Security Rule §164.312(a)(2)(iv)

Art. 9(2) Maintain high standards of authenticity and integrity of data at rest, in use, or in transit

Measured boot chain verified on every power-on. Any firmware modification — supply chain implant, evil-maid attack, or malicious update — fails attestation before the OS loads.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure desktop NitroPC 2 $1,085 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 SI-7 NIST CSF 2.0 DE.CM-09 ISO 27001 A.8.8 SOC 2 CC7.1 NIS2 Art.21(2)(e) CMMC 2.0 SI.L2-3.14.6 CIS Controls v8 CIS-2.3 PCI DSS 4.0.1 11.5.2 HIPAA Security Rule §164.312(c)(1) Cyber Essentials CE-2

Art. 9(4)(c) Policies limiting physical or logical access to information assets and ICT assets

VM-level compartmentalization means a compromise of one domain (e.g. browser) cannot reach another (e.g. keys, vault). No other consumer laptop provides this by default.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-3 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.6 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.3 CIS Controls v8 CIS-12.2 PCI DSS 4.0.1 2.2.1 HIPAA Security Rule §164.312(a)(1)

Art. 9(4)(b) Robust network and infrastructure management using appropriate techniques and methods

Stateful firewall with IPS at the network perimeter. All inbound/outbound traffic inspected with Suricata rule sets. VPN gateway replaces consumer VPN dependency.

Products that satisfy this control:

Network security NitroWall V1410 $835 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Network Network appliances DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 SC-7 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.7 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.1 CIS Controls v8 CIS-12.3 PCI DSS 4.0.1 1.4.1 HIPAA Security Rule §164.312(e)(1) Cyber Essentials CE-1

Art. 9(2) High standards of confidentiality of data at rest

Hardware-encrypted storage and self-hosted file servers replace cloud storage with hardware you control. Encryption keys never leave your environment.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure storage NextBox NAS $450 Hardware security module Nitrokey HSM 2 $135 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure storage Nitrokey Storage 2 (64 GB) $250 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-28 NIST CSF 2.0 PR.DS-01 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.16 CIS Controls v8 CIS-3.11 PCI DSS 4.0.1 3.5.1 HIPAA Security Rule §164.312(a)(2)(iv)

Art. 28 General principles for sound management of ICT third-party risk

Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Secure storage Nitrokey Storage 2 (64 GB) $250 Hardened phone NitroPhone 10a $810 Secure desktop NitroPC 2 $1,085 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SR-3 NIST CSF 2.0 GV.SC-06 ISO 27001 A.5.19 SOC 2 CC9.2 NIS2 Art.21(2)(d) CMMC 2.0 CM.L2-3.4.1 CIS Controls v8 CIS-15.1 PCI DSS 4.0.1 12.8.1 HIPAA Security Rule §164.308(b)(1)

Art. 9(4)(c) Policies limiting physical access to information assets and ICT assets

Rated safes and vaults protect physical assets, documents, and hardware backups with UL-certified burglary ratings — from UL 1037 RSC (residential) up to UL 687 TL-15/TL-30 vault-grade for insurance-mandated or enterprise specialty storage (the tier insurers and auditors recognize; see the ratings ladder on /safe). SecurityTitan laptops extend physical protection to devices in transit: glitter-sealed tamper-evident screws with photographic verification make case intrusion detectable.

Products that satisfy this control:

Physical Safe & vault Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Physical Tamper-evident & locks Signal blocking Faraday bags

Same control in other frameworks:

NIST 800-53 PE-3 NIST CSF 2.0 PR.AC-2 ISO 27001 A.7.1 SOC 2 CC6.4 NIS2 Art.21(2)(i) CMMC 2.0 PE.L1-3.10.1 CIS Controls v8 CIS-11.5 PCI DSS 4.0.1 9.4.1 HIPAA Security Rule §164.310(a)(1)

Art. 11 ICT response and recovery — continuity of critical or important functions

Encrypted LoRa mesh radios (Meshtastic / MeshCore / Reticulum) move text and GPS with no cellular, WiFi, internet, or subscription — every node relays for every other, on FCC Part 15 unlicensed 915 MHz spectrum. The out-of-band channel for disaster response, incident communications when primary networks are down or untrusted, remote sites, and executive contingency plans.

Products that satisfy this control:

Off-grid comms LoRa mesh radios DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 CP-11 NIST CSF 2.0 RC.CO-04 ISO 27001 A.5.30 SOC 2 A1.3 NIS2 Art.21(2)(j) CMMC 2.0 IR.L2-3.6.1 CIS Controls v8 CIS-17 HIPAA Security Rule §164.308(a)(7)(ii)(C)

Art. 9(2) High standards of confidentiality of data in transit

Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Network security NitroWall V1410 $835 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy Mullvad VPN Off-grid comms LoRa mesh radios

Same control in other frameworks:

NIST 800-53 SC-8 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.26 SOC 2 CC6.7 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.8 CIS Controls v8 CIS-3.10 PCI DSS 4.0.1 4.2.1 HIPAA Security Rule §164.312(e)(2)(ii)

Also mapped to

NIST 800-53 US NIST CSF 2.0 US ISO 27001 Global SOC 2 US NIS2 EU CMMC 2.0 US DoD PCI DSS 4.0.1 Payments HIPAA Security Rule US HHS Essential Eight AU Cyber Essentials UK CIS Controls v8 Global