From NIS2 to the Station House: A Document-Thematic Analysis of ENISA Guidance to Derive Minimum Operational Controls for Police Organizations
From NIS2 to the Station House: A Document-Thematic Analysis of ENISA Guidance to Derive Minimum Operational Controls for Police Organizations

Summary/Abstract: This study dives into the NIS2 Directive and ENISA guidance to pinpoint the essential operational controls andworkflows that police organizations need to bolster internal security. Through a thematic analysis of publicly availabledocuments from 2018 to 2025, we explore ENISA’s resources, think incident reporting, threat landscape insights, and sectorspecificrecommendations, alongside NIS2’s security and incident-handling requirements as our core dataset. We frame ouranalysis around three key questions: RQ1) What are the must-have controls and workflows for police organizations? RQ2)Where do these documents align or clash? RQ3) How can we craft a practical, ready-to-use checklist for practitioners? Usingten predefined categories, Legality, Necessity, Proportionality, Accountability, Data Minimization, Logging/Traceability, InteragencyCoordination, Training, Procurement/Vendor Controls, and Incident Workflow, we systematically code the documents.Our findings are distilled into three outputs: i) a matrix linking documents to specific requirements and tangible operationaltools (like logs, escalation protocols, or evidence-handling steps), ii) a RACI chart mapping responsibilities across police, cyberunits, prosecutors, and critical-infrastructure operators, and iii) a gap heatmap spotlighting areas that need clearer guidance,such as chain-of-custody in cyber-physical incidents or proportionality in OSINT-driven responses. The result is a practical,vendor-neutral Minimum Operational Controls Checklist paired with a decision-flow model, translating complex NIS2/ENISArequirements into actionable steps for police organizations. We wrap up with tailored implementation tips for police academiesand command structures, focusing on training priorities, procurement strategies, and audit-ready logging practices. Thisapproach ensures compliance while safeguarding public trust and individual rights.

• Details
• Contents