NIS2 Guide

Evaluation of the information security measures defined in the risk management phase

Critical

High

Normal

Low

Identifying critical functions and related assets

Critical

High

Normal

Low

Continuity management

2.2: Compliance monitoring

1. The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.

2. The relevant entities shall put in place an effective compliance reporting system which shall be appropriate to their structures, operating environments and threat landscapes. The compliance reporting system shall be capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks.

3. The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

No items found.

2.1.2: Cybersecurity risk management process

For the purpose of point 2.1.1, the relevant entities shall establish procedures for identification, analysis, assessment and treatment of risks (‘cybersecurity risk management process’). The cybersecurity risk management process shall be an integral part of the relevant entities’ overall risk management process, where applicable. As part of the cybersecurity risk management process, the relevant entities shall:

follow a risk management methodology;
establish the risk tolerance level in accordance with the risk appetite of the relevant entities;
establish and maintain relevant risk criteria;
in line with an all-hazards approach, identify and document the risks posed to the security of network and information systems, in particular in relation to third parties and risks that could lead to disruptions in the availability, integrity, authenticity and confidentiality of the network and information systems, including the identification of single point of failures;
analyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and risk level, taking into account cyber threat intelligence and vulnerabilities;
evaluate the identified risks based on the risk criteria;
identify and prioritise appropriate risk treatment options and measures;
continuously monitor the implementation of the risk treatment measures;
identify who is responsible for implementing the risk treatment measures and when they should be implemented;
document the chosen risk treatment measures in a risk treatment plan and the reasons justifying the acceptance of residual risks in a comprehensible manner.

Related tasks

No items found.

2.1.1: Risk management framework

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities shall establish and maintain an appropriate risk management framework to identify and address the risks posed to the security of network and information systems. The relevant entities shall perform and document risk assessments and, based on the results, establish, implement and monitor a risk treatment plan. Risk assessment results and residual risks shall be accepted by management bodies or, where applicable, by persons who are accountable and have the authority to manage risks, provided that the relevant entities ensure adequate reporting to the management bodies.

Related tasks

Risk management policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Identification and documentation of cyber security risks

Critical

High

Normal

Low

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Monitoring the status of risk management

Critical

High

Normal

Low

6.7(i): Network security secure inter-system communication

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Network segmentation for secure communications

Critical

High

Normal

Low

Policy for secure internal communication tools

Critical

High

Normal

Low

Security guidelines

Secure transmission of confidential information over a data network

Critical

High

Normal

Low

Encryption

6.2: Secure development life cycle

1. Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.

2. For the purpose of point 6.2.1, the relevant entities shall:

carry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;
apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;
lay down security requirements regarding development environments;
establish and implement security testing processes in the development life cycle;
appropriately select, protect and manage security test data;
sanitise and anonymise testing data according to the risk assessment carried out pursuant to point 2.1.

3. For outsourced development of network and information systems, the relevant entities shall also apply the policies and procedures referred to in points 5 and 6.1.

4. The relevant entities shall review and, where necessary, update their secure development rules at planned intervals.

Related tasks

Security in the product development process

Critical

High

Normal

Low

Zero trust architecture in authentication

Critical

High

Normal

Low

Process for monitoring and tracking outsourced development work

Critical

High

Normal

Low

Guidelines for secure development

Critical

High

Normal

Low

General rules for reviewing and publishing code

Critical

High

Normal

Low

Technical vulnerability management

6.10.3: Mitigation planning for vulnerabilities

When justified by the potential impact of the vulnerability, the relevant entities shall create and implement a plan to mitigate the vulnerability. In other cases, the relevant entities shall document and substantiate the reason why the vulnerability does not require remediation.

Related tasks

Process for vulnerability remediation

Critical

High

Normal

Low

Prioritization of identified technical vulnerabilities and remediation goals

Critical

High

Normal

Low

Technical vulnerability management

Risk level accepted by the organization

Critical

High

Normal

Low

6.1: Security in acquisition of ICT services or ICT products

1. For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities shall set and implement processes to manage risks stemming from the acquisition of ICT services or ICT products for components that are critical for the relevant entities’ security of network and information systems, based on the risk assessment carried out pursuant to point 2.1, from suppliers or service providers throughout their life cycle.

2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include:

security requirements to apply to the ICT services or ICT products to be acquired;
requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;
information describing the hardware and software components used in the ICT services or ICT products;
information describing the implemented cybersecurity functions of the ICT services or ICT products and the configuration required for their secure operation;
assurance that the ICT services or ICT products comply with the security requirements according to point (a);
methods for validating that the delivered ICT services or ICT products are compliant to the stated security requirements, as well as documentation of the results of the validation.

3. The relevant entities shall review and, where appropriate, update the processes at planned intervals and when significant incidents occur.

Related tasks

Risk assessment for new acquisitions

Critical

High

Normal

Low

Agreements and monitoring

Phasing out outdated ICT products

Critical

High

Normal

Low

Data system management

Management of procurement and use of external IT services

Critical

High

Normal

Low

Criteria for suppliers of high priority data systems

Critical

High

Normal

Low

Security rules for the development and acquisition of data systems

Critical

High

Normal

Low

General rules for the procurement of data systems

Critical

High

Normal

Low

Change management procedure for significant changes to data processing services

Critical

High

Normal

Low

Requiring a system description from suppliers of important information systems to be acquired

Critical

High

Normal

Low

Comprehensiveness of contractual terms for cloud service provisioning

Critical

High

Normal

Low

6.5: Security testing

1. The relevant entities shall establish, implement and apply a policy and procedures for security testing.

2. The relevant entities shall:

establish, based on the risk assessment carried out pursuant to point 2.1, the need, scope, frequency and type of security tests;
carry out security tests according to a documented test methodology, covering the components identified as relevant for secure operation in a risk analysis;
document the type, scope, time and results of the tests, including assessment of criticality and mitigating actions for each finding;
apply mitigating actions in case of critical findings.

3. The relevant entities shall review and, where appropriate, update their security testing policies at planned intervals.

Related tasks

Managing actively exploited vulnerabilities

Critical

High

Normal

Low

Regular testing and documentation of security controls

Critical

High

Normal

Low

Data system management

Testing security functions that are affected by the changes to ICT systems

Critical

High

Normal

Low

Cyber security management

Defining and documenting cyber security metrics

Critical

High

Normal

Low

6.4: Change management, repairs and maintenance

1. The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities’ general policies concerning change management.

2. The procedures referred to in point 6.4.1 shall be applied for releases, modifications and emergency changes of any software and hardware in operation and changes to the configuration. The procedures shall ensure that those changes are documented and, based on the risk assessment carried out pursuant to point 2.1, tested and assessed in view of the potential impact before being implemented.

3. In the event that the regular change management procedures could not be followed due to an emergency, the relevant entities shall document the result of the change, and the explanation for why the procedures could not be followed.

4. The relevant entities shall review and, where appropriate, update the procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Related tasks

Documentation of the change management procedure

Critical

High

Normal

Low

Data system management

Establishing change management procedures

Critical

High

Normal

Low

Change management procedure for significant changes to data processing services

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

6.7(a): Network security architecture

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: document the architecture of the network in a comprehensible and up-to-date manner.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Verification of network documentation

Critical

High

Normal

Low

Establishing and maintaining diagram(s) of architecture

Critical

High

Normal

Low

Determining the responsibility of network devices

Critical

High

Normal

Low

6.8: Network segmentation

1. The relevant entities shall segment systems into networks or zones in accordance with the results of the risk assessment referred to in point 2.1. They shall segment their systems and networks from third parties’ systems and networks.

2. For that purpose, the relevant entities shall:

consider the functional, logical and physical relationship, including location, between trustworthy systems and services;
grant access to a network or zone based on an assessment of its security requirements;
keep systems that are critical to the relevant entities operation or to safety in secured zones;
deploy a demilitarised zone within their communication networks to ensure secure communication originating from or destined to their networks;
restrict access and communications between and within zones to those necessary for the operation of the relevant entities or for safety;
separate the dedicated network for administration of network and information systems from the relevant entities’ operational network;
segregate network administration channels from other network traffic;
separate the production systems for the relevant entities’ services from systems used in development and testing, including backups.

3. The relevant entities shall review and, where appropriate, update network segmentation at planned intervals and when significant incidents or significant changes to operations or risks.

Related tasks

Network security and segregation

Critical

High

Normal

Low

Performing traffic filtering between network segments

Critical

High

Normal

Low

Detailed procedures for the management, control and segmentation of networks

Critical

High

Normal

Low

Network segmentation and filtering practices within the classification level

Critical

High

Normal

Low

6.7(b): Network security Internal access control

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: determine and apply controls to protect the relevant entities’ internal network domains from unauthorised access.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Deploying port-level access control

Critical

High

Normal

Low

Network usage log and process for detecting inappropriate network traffic

Critical

High

Normal

Low

Implementing formal access control processes

Critical

High

Normal

Low

Determining the responsibility of network devices

Critical

High

Normal

Low

Management of filtering and monitoring systems

Critical

High

Normal

Low

Choosing and using network protection systems

Critical

High

Normal

Low

Virtualization

6.10.1: Vulnerability management process

The relevant entities shall obtain information about technical vulnerabilities in their network and information systems, evaluate their exposure to such vulnerabilities, and take appropriate measures to manage the vulnerabilities.

Related tasks

No items found.

6.10.4: Review of vulnerability information sources

The relevant entities shall review and, where appropriate, update at planned intervals the channels they use for monitoring vulnerability information.

Related tasks

No items found.

6.7(c): Network security restriction of unnecessary network communication

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: configure controls to prevent accesses and network communication not required for the operation of the relevant entities.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Network perimeter security and firewall governance

Critical

High

Normal

Low

Secure network design and encryption measures

Critical

High

Normal

Low

Using of secure communication protocols and network management

Critical

High

Normal

Low

Detailed procedures for the management, control and segmentation of networks

Critical

High

Normal

Low

Regular reviewing of data system access rights

Critical

High

Normal

Low

Implementing formal access control processes

Critical

High

Normal

Low