{"id":"https://openalex.org/W7117720882","doi":"https://doi.org/10.7250/csimq.2025-45.07","title":"Toward NIS2 Compliance for Multiple Stakeholders with Security Level Evaluation Framework","display_name":"Toward NIS2 Compliance for Multiple Stakeholders with Security Level Evaluation Framework","publication_year":2025,"publication_date":"2025-12-31","ids":{"openalex":"https://openalex.org/W7117720882","doi":"https://doi.org/10.7250/csimq.2025-45.07"},"language":"en","primary_location":{"id":"doi:10.7250/csimq.2025-45.07","is_oa":true,"landing_page_url":"https://doi.org/10.7250/csimq.2025-45.07","pdf_url":"https://csimq-journals.rtu.lv/csimq/article/download/csimq.2025-45.07/295","source":{"id":"https://openalex.org/S4210218084","display_name":"Complex Systems Informatics and Modeling Quarterly","issn_l":"2255-9922","issn":["2255-9922"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310314131","host_organization_name":"Riga Technical University","host_organization_lineage":["https://openalex.org/P4310314131"],"host_organization_lineage_names":["Riga Technical University"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex Systems Informatics and Modeling Quarterly","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://csimq-journals.rtu.lv/csimq/article/download/csimq.2025-45.07/295","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5065660439","display_name":"Mari Seeba","orcid":"https://orcid.org/0000-0002-9066-2467"},"institutions":[{"id":"https://openalex.org/I130923123","display_name":"Institute of the Estonian Language","ror":"https://ror.org/041dzw371","country_code":"EE","type":"facility","lineage":["https://openalex.org/I130923123"]}],"countries":["EE"],"is_corresponding":false,"raw_author_name":"Mari Seeba","raw_affiliation_strings":["Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia and NCSC-EE, Estonian State Information Authority, P\u00e4rnu mnt 139a, 15169 Tallinn, Estonia"],"raw_orcid":"https://orcid.org/0000-0002-9066-2467","affiliations":[{"raw_affiliation_string":"Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia and NCSC-EE, Estonian State Information Authority, P\u00e4rnu mnt 139a, 15169 Tallinn, Estonia","institution_ids":["https://openalex.org/I130923123"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103010598","display_name":"T. Oja","orcid":"https://orcid.org/0000-0003-3301-7020"},"institutions":[{"id":"https://openalex.org/I56085075","display_name":"University of Tartu","ror":"https://ror.org/03z77qz90","country_code":"EE","type":"education","lineage":["https://openalex.org/I56085075"]}],"countries":["EE"],"is_corresponding":false,"raw_author_name":"Tarmo Oja","raw_affiliation_strings":["Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia and Cybernetica AS, M\u00e4ealuse 2/1. 12618 Tallinn, Estonia"],"raw_orcid":"https://orcid.org/0000-0003-3301-7020","affiliations":[{"raw_affiliation_string":"Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia and Cybernetica AS, M\u00e4ealuse 2/1. 12618 Tallinn, Estonia","institution_ids":["https://openalex.org/I56085075"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007839618","display_name":"Sten M\u00e4ses","orcid":null},"institutions":[{"id":"https://openalex.org/I111112146","display_name":"Tallinn University of Technology","ror":"https://ror.org/0443cwa12","country_code":"EE","type":"education","lineage":["https://openalex.org/I111112146"]}],"countries":["EE"],"is_corresponding":false,"raw_author_name":"Sten M\u00e4ses","raw_affiliation_strings":["Department of Software Science, Tallinn University of Technology, Ehitajate tee 5, 19086 Tallinn, Estonia"],"raw_orcid":"https://orcid.org/0000-0002-1599-8649","affiliations":[{"raw_affiliation_string":"Department of Software Science, Tallinn University of Technology, Ehitajate tee 5, 19086 Tallinn, Estonia","institution_ids":["https://openalex.org/I111112146"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043929833","display_name":"Maria Murumaa","orcid":"https://orcid.org/0009-0006-4908-637X"},"institutions":[{"id":"https://openalex.org/I4210160054","display_name":"Cybernetica (Estonia)","ror":"https://ror.org/054gqc795","country_code":"EE","type":"company","lineage":["https://openalex.org/I4210160054"]}],"countries":["EE"],"is_corresponding":false,"raw_author_name":"Maria Pibilota Murumaa","raw_affiliation_strings":["Cybernetica AS, M\u00e4ealuse 2/1. 12618 Tallinn, Estonia"],"raw_orcid":"https://orcid.org/0009-0006-4908-637X","affiliations":[{"raw_affiliation_string":"Cybernetica AS, M\u00e4ealuse 2/1. 12618 Tallinn, Estonia","institution_ids":["https://openalex.org/I4210160054"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5066884035","display_name":"Raimundas Matulevi\u010dius","orcid":"https://orcid.org/0000-0002-1829-4794"},"institutions":[{"id":"https://openalex.org/I56085075","display_name":"University of Tartu","ror":"https://ror.org/03z77qz90","country_code":"EE","type":"education","lineage":["https://openalex.org/I56085075"]}],"countries":["EE"],"is_corresponding":false,"raw_author_name":"Raimundas Matulevi\u010dius","raw_affiliation_strings":["Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia"],"raw_orcid":"https://orcid.org/0000-0002-1829-4794","affiliations":[{"raw_affiliation_string":"Institute of Computer Science, University of Tartu, Narva mnt 18, 51009 Tartu, Estonia","institution_ids":["https://openalex.org/I56085075"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.70611015,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":"45","first_page":"136","last_page":"159"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8740000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8740000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.0284000001847744,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.012600000016391277,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.5672000050544739},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.5307999849319458},{"id":"https://openalex.org/keywords/scope","display_name":"Scope (computer science)","score":0.5289000272750854},{"id":"https://openalex.org/keywords/directive","display_name":"Directive","score":0.5145000219345093},{"id":"https://openalex.org/keywords/information-security-management","display_name":"Information security management","score":0.5055999755859375},{"id":"https://openalex.org/keywords/service-level","display_name":"Service level","score":0.47839999198913574},{"id":"https://openalex.org/keywords/security-management","display_name":"Security management","score":0.4756999909877777},{"id":"https://openalex.org/keywords/service","display_name":"Service (business)","score":0.45809999108314514},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.4530999958515167},{"id":"https://openalex.org/keywords/relation","display_name":"Relation (database)","score":0.3815000057220459}],"concepts":[{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.5672000050544739},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.5307999849319458},{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.5289000272750854},{"id":"https://openalex.org/C2779547435","wikidata":"https://www.wikidata.org/wiki/Q1121492","display_name":"Directive","level":2,"score":0.5145000219345093},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.5055999755859375},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4970000088214874},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4887000024318695},{"id":"https://openalex.org/C181889124","wikidata":"https://www.wikidata.org/wiki/Q380204","display_name":"Service level","level":2,"score":0.47839999198913574},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.4756999909877777},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4722000062465668},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.45809999108314514},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.4530999958515167},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.4253000020980835},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.3815000057220459},{"id":"https://openalex.org/C2780952636","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident management","level":2,"score":0.3774999976158142},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.37630000710487366},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.3686000108718872},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.35359999537467957},{"id":"https://openalex.org/C52420254","wikidata":"https://www.wikidata.org/wiki/Q7445028","display_name":"Security convergence","level":5,"score":0.3447999954223633},{"id":"https://openalex.org/C117110713","wikidata":"https://www.wikidata.org/wiki/Q3394676","display_name":"Network security policy","level":4,"score":0.33970001339912415},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.31220000982284546},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.31209999322891235},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.29829999804496765},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.29660001397132874},{"id":"https://openalex.org/C180823521","wikidata":"https://www.wikidata.org/wiki/Q1662502","display_name":"Certified Information Security Manager","level":5,"score":0.2921999990940094},{"id":"https://openalex.org/C111153917","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management system","level":5,"score":0.29010000824928284},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.28119999170303345},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.2793999910354614},{"id":"https://openalex.org/C121017731","wikidata":"https://www.wikidata.org/wiki/Q11661","display_name":"Information technology","level":2,"score":0.27149999141693115},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.26489999890327454},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C2778652015","wikidata":"https://www.wikidata.org/wiki/Q7445019","display_name":"Security awareness","level":3,"score":0.2508000135421753},{"id":"https://openalex.org/C67069471","wikidata":"https://www.wikidata.org/wiki/Q1140205","display_name":"IT service continuity","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.7250/csimq.2025-45.07","is_oa":true,"landing_page_url":"https://doi.org/10.7250/csimq.2025-45.07","pdf_url":"https://csimq-journals.rtu.lv/csimq/article/download/csimq.2025-45.07/295","source":{"id":"https://openalex.org/S4210218084","display_name":"Complex Systems Informatics and Modeling Quarterly","issn_l":"2255-9922","issn":["2255-9922"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310314131","host_organization_name":"Riga Technical University","host_organization_lineage":["https://openalex.org/P4310314131"],"host_organization_lineage_names":["Riga Technical University"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex Systems Informatics and Modeling Quarterly","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:8b629a592def49a2a655653029b9c80d","is_oa":true,"landing_page_url":"https://doaj.org/article/8b629a592def49a2a655653029b9c80d","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Complex Systems Informatics and Modeling Quarterly, Iss 45 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.7250/csimq.2025-45.07","is_oa":true,"landing_page_url":"https://doi.org/10.7250/csimq.2025-45.07","pdf_url":"https://csimq-journals.rtu.lv/csimq/article/download/csimq.2025-45.07/295","source":{"id":"https://openalex.org/S4210218084","display_name":"Complex Systems Informatics and Modeling Quarterly","issn_l":"2255-9922","issn":["2255-9922"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310314131","host_organization_name":"Riga Technical University","host_organization_lineage":["https://openalex.org/P4310314131"],"host_organization_lineage_names":["Riga Technical University"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Complex Systems Informatics and Modeling Quarterly","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5185462236404419,"display_name":"Industry, innovation and infrastructure"}],"awards":[{"id":"https://openalex.org/G8310821850","display_name":"Cyber-security Excellence Hub in Estonia and South Moravia","funder_award_id":"101087529","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320334679","display_name":"Research Executive Agency","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7117720882.pdf","grobid_xml":"https://content.openalex.org/works/W7117720882.grobid-xml"},"referenced_works_count":20,"referenced_works":["https://openalex.org/W1500782201","https://openalex.org/W2040127838","https://openalex.org/W2136922540","https://openalex.org/W2159024459","https://openalex.org/W2485113444","https://openalex.org/W2572590934","https://openalex.org/W2735887463","https://openalex.org/W3034690165","https://openalex.org/W3044094540","https://openalex.org/W3147211262","https://openalex.org/W4285216026","https://openalex.org/W4384831023","https://openalex.org/W4385688235","https://openalex.org/W4399007258","https://openalex.org/W4403413389","https://openalex.org/W4406094995","https://openalex.org/W4406424146","https://openalex.org/W4406887011","https://openalex.org/W4411261558","https://openalex.org/W4411816204"],"related_works":[],"abstract_inverted_index":{"The":[0,146],"revised":[1],"Network":[2],"and":[3,28,68,121,158],"Information":[4],"Security":[5],"Directive":[6],"(NIS2)":[7],"aims":[8],"to":[9,35,100,134,161],"achieve":[10,135],"a":[11,41],"high":[12,42],"level":[13,43,103,128,144],"of":[14,44,48,64,76,92,105,115,142,148],"common":[15],"cybersecurity":[16],"across":[17],"the":[18,65,74,101,112,124,152],"European":[19],"Union.":[20],"Several":[21],"stakeholders,":[22],"including":[23],"member":[24],"states,":[25],"supervisory":[26],"authorities,":[27],"critical":[29],"infrastructure":[30],"service":[31,58],"providers,":[32,59],"are":[33],"expected":[34],"support":[36],"this":[37,108,139],"effort":[38],"by":[39,57],"ensuring":[40],"information":[45],"security.":[46],"Part":[47],"increasing":[49],"security":[50,66,102,117,127,143],"levels":[51],"involves":[52],"implementing":[53],"risk":[54],"management":[55],"measures":[56],"but":[60],"also":[61],"an":[62,167],"evaluation":[63,104,118,129],"situation":[67],"its":[69],"changes":[70],"is":[71,150],"necessary":[72],"from":[73],"perspective":[75],"each":[77],"stakeholder.":[78],"Previous":[79],"research":[80],"has":[81],"described":[82],"NIS2-related":[83],"activities":[84],"through":[85],"user":[86,119],"stories":[87,120],"that":[88,151,173],"encompass":[89],"six":[90],"types":[91],"stakeholders":[93,164],"with":[94],"their":[95],"respective":[96],"goals":[97],"in":[98],"relation":[99],"organizations.":[106],"In":[107],"article,":[109],"we":[110],"examine":[111],"real-life":[113],"implementation":[114],"these":[116],"demonstrate":[122],"how":[123],"framework":[125],"for":[126],"(F4SLE)":[130],"can":[131,154],"be":[132,155,175],"utilized":[133],"NIS2":[136],"compliance":[137],"within":[138],"narrowed":[140],"scope":[141],"evaluation.":[145],"advantage":[147],"F4SLE":[149],"data":[153],"collected":[156],"once":[157],"then":[159],"reused":[160],"satisfy":[162],"different":[163],"without":[165],"imposing":[166],"additional":[168],"reporting":[169],"burden":[170],"on":[171],"entities":[172],"must":[174],"NIS2-compliant.":[176]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-12-31T00:00:00"}