Article 21 of NIS2: the proportionate, all-hazards duty to manage risks to network and information systems and the ten minimum measures in Article 21(2)(a) to (j), with the implementing regulation's requirements for each.
The general Article 21 duty: technical, operational and organizational measures proportionate to risk, the state of the art and cost, plus the Article 21(4) duty to correct non-compliance without undue delay.
The first minimum measure: documented policies on risk analysis and information system security, which the implementing regulation expands into a security policy, roles, a risk management framework, compliance monitoring and independent review.
The incident handling measure: a policy and procedures to detect, analyze, contain, respond to, recover from, document and report incidents, linked to the Article 23 notification duties.
Business continuity, backup management, disaster recovery and crisis management under NIS2, with the implementing regulation's requirements for plans, business impact analysis, redundancy and crisis processes.
Supply chain security toward direct suppliers and service providers: what Article 21(3) asks entities to weigh, and the supplier selection criteria, contract clauses and supplier registry in the implementing regulation.
Security across the system life cycle, including vulnerability handling and disclosure: the umbrella measure that the implementing regulation splits into ten areas, from secure acquisition and development to patching and network segmentation.
Policies and procedures to check whether cybersecurity risk-management measures actually work: what to measure, how, when and by whom, and how results feed management and risk treatment.
Basic cyber hygiene practices and cybersecurity training for staff, management and, where appropriate, suppliers, with the implementing regulation's awareness program and role-based training requirements.
Policies and procedures on cryptography and, where appropriate, encryption, including the implementing regulation's requirements on approved algorithms, cryptographic agility and the full key management life cycle.
The combined measure covering people, access and assets, which the implementing regulation splits into human resources security, access control and asset management requirements.
Multi-factor or continuous authentication and secured voice, video, text and emergency communications where appropriate, with the implementing regulation's authentication requirements.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.