--- title: "Article 25 — Standardisation" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" source_retrieved: 2026-10-01 shortTitle: "Article 25 — Standardisation" instrument_type: level1_directive authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Directive (EU) 2022/2555" instrument: nis2 celex: "32022L2555" regulation: NIS2 regulation-full: "Directive (EU) 2022/2555" article: 25 status: in_force object_id: eu.nis2.legal_text.article.25 text_version: "Consolidated version of 27 December 2022" source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227" check_status: matched verified: true last_checked: 2026-10-26 --- *In force · Consolidated version of 27 December 2022 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227)* 1. In order to promote the convergent implementation of [Article 21(1)](21.md) and (2), Member States shall, without imposing or discriminating in favour of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the [security of network and information systems](https://www.headlesslaw.com/definitions/nis2/security-of-network-and-information-systems). 2. ENISA, in cooperation with Member States, and, where appropriate, after consulting relevant stakeholders, shall draw up advice and guidelines regarding the technical areas to be considered in relation to paragraph 1 as well as regarding already existing standards, including national standards, which would allow for those areas to be covered. *** [Chapter IV — Cybersecurity risk-management measures and reporting obligations](../chapters/iv.md) · [← Article 24](24.md) · [Article 26 →](26.md)