NIS2 Guide

Incident management and response

System testing as a part of acquisition procedure

Critical

High

Normal

Low

Data system procurement

Regular periodic analysis and learning of incidents

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

Configuration management and change log

Critical

High

Normal

Low

6.7(e): Network security dedicated security administration systems

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: not use systems used for administration of the security policy implementation for other purposes.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

No items found.

Access control and authentication

6.7(g): Network security authorised device access

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, where appropriate, the relevant entities shall: where appropriate, exclusively allow access to their network and information systems by devices authorised by those entities.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Device inventory

Critical

High

Normal

Low

Mobile device management

Management of device and system identities

Critical

High

Normal

Low

Security measures of devices used to transfer data

Critical

High

Normal

Low

Removable media

Network configuration security

Critical

High

Normal

Low

Configuring trusted DNS servers on enterprise assets

Critical

High

Normal

Low

Personnel guidelines for approved devices and software

Critical

High

Normal

Low

Security guidelines

6.7(d): Network security remote access control

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: determine and apply controls for remote access to network and information systems, including access by service providers.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Authentication mechanisms for remote access

Critical

High

Normal

Low

Remote work

Definition of measures permitted in remote work

Critical

High

Normal

Low

Remote work

Personnel guidelines for secure remote work

Critical

High

Normal

Low

Remote work

Remote connection management

Critical

High

Normal

Low

6.7(h): Network security service provider access

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Process for temporary network access for service providers

Critical

High

Normal

Low

Supplier security

Minimum requirements for partner companies to gain access to different levels of information

Critical

High

Normal

Low

Supplier security

6.7(j): Network security protocol transition

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: adopt an implementation plan for the full transition towards latest generation network layer communication protocols in a secure, appropriate and gradual way and establish measures to accelerate such transition.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Planned transition to modern network communication protocols

Critical

High

Normal

Low

6.7(k): Network security e-mail communication standards

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: adopt an implementation plan for the deployment of internationally agreed and interoperable modern e-mail communications standards to secure e-mail communications to mitigate vulnerabilities linked to e-mail-related threats and establish measures to accelerate such deployment.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Secure email communications plan

Critical

High

Normal

Low

Email authentication: SPF

Critical

High

Normal

Low

Email authentication: DKIM

Critical

High

Normal

Low

Email authentication: DMARC

Critical

High

Normal

Low

6.9: Protection against malicious and unauthorised software

1. The relevant entities shall protect their network and information systems against malicious and unauthorised software.

2. For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response software, which is updated regularly in accordance with the risk assessment carried out pursuant to point 2.1 and the contractual agreements with the providers.

Related tasks

Agreement with a cybersecurity service provider

Critical

High

Normal

Low

Automatic blocking and detecting of unauthorized software

Critical

High

Normal

Low

Malware protection

Selection and use of malware detection software on all devices

Critical

High

Normal

Low

Malware protection

Procedures and data sources for gathering reliable information about malware

Critical

High

Normal

Low

Malware protection

Maintenance and updates of security systems that detect vulnerabilities

Critical

High

Normal

Low

6.6: Security patch management

1. The relevant entities shall specify and apply procedures, coherent with the change management procedures referred to in point 6.4.1 as well as with vulnerability management, risk management and other relevant management procedures, for ensuring that:

security patches are applied within a reasonable time after they become available;
security patches are tested before being applied in production systems;
security patches come from trusted sources and are checked for integrity;
additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2.

2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply security patches when the disadvantages of applying the security patches outweigh the cybersecurity benefits. The relevant entities shall duly document and substantiate the reasons for any such decision.

Related tasks

Risk-based justification for excluding security patches

Critical

High

Normal

Low

Organising the distribution of updates

Critical

High

Normal

Low

Regular security updates for offered products

Critical

High

Normal

Low

Defining a patch management process

Critical

High

Normal

Low

Process for managing technical vulnerabilities

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Risk management

6.10.2: Vulnerability monitoring and handling

For the purpose of point 6.10.1, the relevant entities shall:

monitor information about vulnerabilities through appropriate channels, such as announcements of CSIRTs, competent authorities or information provided by suppliers or service providers;
perform, where appropriate, vulnerability scans, and record evidence of the results of the scans, at planned intervals;
address, without undue delay, vulnerabilities identified by the relevant entities as critical to their operations;
ensure that their vulnerability handling is compatible with their change management, security patch management, risk management and incident management procedures;
lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy.

Related tasks

Process for vulnerability disclosure

Critical

High

Normal

Low

Process for handling and sharing vulnerability disclosures

Critical

High

Normal

Low

Regular vulnerability scanning

Critical

High

Normal

Low

Process for managing technical vulnerabilities

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Risk management

Defining metrics related to vulnerability management

Critical

High

Normal

Low

Monitoring of technical vulnerability communications

Critical

High

Normal

Low

6.7(f): Network security deactivation of unneeded connections and services

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: explicitly forbid or deactivate unneeded connections and services.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Minimizing the risk of attack by limiting attack surfaces

Critical

High

Normal

Low

Choosing and using network protection systems

Critical

High

Normal

Low

Virtualization

Removing unnecessary software and network services

Critical

High

Normal

Low

Security systems and logging

6.7(l): Network security DNS and Internet routing security

1. The relevant entities shall take the appropriate measures to protect their network and information systems from cyber threats.

2. For the purpose of point 6.7.1, the relevant entities shall: apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.

3. The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Collecting DNS query audit logs

Critical

High

Normal

Low

Using of DNS filtering services

Critical

High

Normal

Low

Access control and authentication

Configuring trusted DNS servers on enterprise assets

Critical

High

Normal

Low

13.1: Supporting utilities

1. For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities shall prevent loss, damage or compromise of network and information systems or interruption to their operations due to the failure and disruption of supporting utilities.

2. For that purpose, the relevant entities shall, where appropriate:

protect facilities from power failures and other disruptions caused by failures in supporting utilities such as electricity, telecommunications, water supply, gas, sewage, ventilation and air conditioning;
consider the use of redundancy in utilities services;
protect utility services for electricity and telecommunications, which transport data or supply network and information systems, against interception and damage;
monitor the utility services referred to in point (c) and report to the competent internal or external personnel events outside the minimum and maximum control thresholds referred to in point 13.2.2(b) affecting the utility services;
conclude contracts for the emergency supply with corresponding services, such as for the fuel for emergency power supply;
ensure continuous effectiveness, monitor, maintain and test the supply of the network and information systems necessary for the operation of the service offered, in particular the electricity, temperature and humidity control, telecommunications and Internet connection.

3. The relevant entities shall test, review and, where appropriate, update the protection measures on a regular basis or following significant incidents or significant changes to operations or risks.

Related tasks

Assessment of facility redundancy for service delivery

Critical

High

Normal

Low

Continuity management

Testing switching to backup and redundant infrastructure

Critical

High

Normal

Low

Continuity management

System capacity planning and resilience

Critical

High

Normal

Low

Notifying the administrative body of incidents

Critical

High

Normal

Low

Key contractual requirements for service providers supporting critical functions

Critical

High

Normal

Low

Basic service testing, fault tolerance evaluation and verification

Critical

High

Normal

Low

Cabling security

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

13.2: Protection against physical and environmental threats

1. For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall prevent or reduce the consequences of events originating from physical and environmental threats, such as natural disasters and other intentional or unintentional threats, based on the results of the risk assessment carried out pursuant to point 2.1.

2. For that purpose, the relevant entities shall, where appropriate:

design and implement protection measures against physical and environmental threats;
determine minimum and maximum control thresholds for physical and environmental threats;
monitor environmental parameters and report to the competent internal or external personnel events outside the minimum and maximum control thresholds referred to in point (b).

3. The relevant entities shall test, review and, where appropriate, update the protection measures against physical and environmental threats on a regular basis or following significant incidents or significant changes to operations or risks.

Related tasks

Creating and maintaining physical and environmental security policy

Critical

High

Normal

Low

Physical security measures for facilities

Critical

High

Normal

Low

Environmental security

Critical

High

Normal

Low

Basic service testing, fault tolerance evaluation and verification

Critical

High

Normal

Low

Safe placement of equipment

Critical

High

Normal

Low

Incident management and response

Consideration of environmental threats in risk and incident management

Critical

High

Normal

Low

13.3: Perimeter and physical access control

1. For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities shall prevent and monitor unauthorised physical access, damage and interference to their network and information systems.

2. For that purpose, the relevant entities shall:

on the basis of the risk assessment carried out pursuant to point 2.1, lay down and use security perimeters to protect areas where network and information systems and other associated assets are located;
protect the areas referred to in point (a) by appropriate entry controls and access points;
design and implement physical security for offices, rooms and facilities,
continuously monitor their premises for unauthorised physical access.

3. The relevant entities shall test, review and, where appropriate, update the physical access control measures on a regular basis or following significant incidents or significant changes to operations or risks.

Related tasks

Protecting connections from physical tampering or damage

Critical

High

Normal

Low

Camera surveillance in real estates

Critical

High

Normal

Low

Preventing eavesdropping

Critical

High

Normal

Low

Visitor instructions and log

Critical

High

Normal

Low

Physical access control to building, offices and other premises

Critical

High

Normal

Low

Continuous monitoring of physical access to critical facilities

Critical

High

Normal

Low

12.4: Asset inventory

1. The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent inventory of their assets. They shall record changes to the entries in the inventory in a traceable manner.

2. The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The inventory shall include the following:

the list of operations and services and their description,
the list of network and information systems and other associated assets supporting the relevant entities’ operations and services.

3. The relevant entities shall regularly review and update the inventory and their assets and document the history of changes.

Related tasks

Asset management strategy

Critical

High

Normal

Low

Processing principles and accountability

Data store listing and owner assignment

Critical

High

Normal

Low

Data system listing and owner assignment

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documenting and delegating ownership of own backup processes

Critical

High

Normal

Low

Backups

Documentation of interfaces for data systems

Critical

High

Normal

Low

Documentation of assets inventories outside the ISMS

Critical

High

Normal

Low

Management of data sets

Documentation of other protected assets

Critical

High

Normal

Low