1.2.1 As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities...
1.2.4 Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.
11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network...
11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.
11.2.2.d ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;
11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.
11.3.2.a establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;
11.3.2.b set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;
11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.
12.1.2.c align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.
2.2.1 The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the...
2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.
2.3.1 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.
3.1.1 For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from,...
3.1.2.d documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.
3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.
3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.
3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.
3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically....
3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.
3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.
4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.
4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons...
4.3.2.a roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;
5.1.4.f an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;
6.1.2.b requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;
6.2.1 Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of...
6.2.2.b apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
6.4.1 The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management.
6.7.2.i establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from...
6.7.2.l apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.
6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response...
9.2.a in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit;
9.2.c.xii setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.
NIS2 is Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, published in the Official Journal on 27.12.2022. It repeals Directive (EU) 2016/1148 and amends Regulation (EU) No 910/2014 and Directive (EU) 2018/1972.
How does NIS2 decide which entities fall in scope?
It uses a uniform size-cap rule.
Are small enterprises ever covered by NIS2?
Member States must provide for certain small enterprises and microenterprises to fall within scope when they fulfil specific criteria that indicate a key role for society, the economy or particular sectors or types of service.
Are public administration entities excluded from NIS2?
Exclusion applies to public administration entities whose activities are predominantly in national security, public security, defence or law enforcement. Entities whose activities are only marginally related to those areas are not excluded.
