NIS2 Guide

Process for secure disposal of removable media containing confidential information

Critical

High

Normal

Low

Removable media

Defining the types of removable media used

Critical

High

Normal

Low

Removable media

Encryption of portable media

Critical

High

Normal

Low

Encryption

Detailed rules for the management of removable media

Critical

High

Normal

Low

Removable media

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

12.2: Handling of assets

1. The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy, and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.

2. The policy shall:

cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;
provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets;
provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.

3. The relevant entities shall review and, where appropriate, update the policy at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Creating and maintaining an asset management policy

Critical

High

Normal

Low

How the system assets are used

Critical

High

Normal

Low

Data system management

Asset management strategy

Critical

High

Normal

Low

Data system management

Handling the loss, misuse, damage and theft of assets

Critical

High

Normal

Low

Security rules for the development and acquisition of data systems

Critical

High

Normal

Low

Data system procurement

Documentation of other protected assets

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

Changes in employment relationships

12.5: Deposit, return or deletion of assets upon termination of employment

The relevant entities shall establish, implement and apply procedures which ensure that their assets which are under custody of personnel are deposited, returned or deleted upon termination of employment, and shall document the deposit, return and deletion of those assets. Where the deposit, return or deletion of assets is not possible, the relevant entities shall ensure that the assets can no longer access the relevant entities’ network and information systems in accordance with point 12.2.2.

Related tasks

Return of assets at termination of employment

Critical

High

Normal

Low

Process for removing hardware and access rights at termination of employment relationship

Critical

High

Normal

Low

Changes in employment relationships

Special supervision of dismissed workers

Critical

High

Normal

Low

Changes in employment relationships

Documentation of other protected assets

Critical

High

Normal

Low

12.1: Asset classification

1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall lay down classification levels of all assets, including information, in scope of their network and information systems for the level of protection required.

2. For the purpose of point 12.1.1, the relevant entities shall:

lay down a system of classification levels for assets;
associate all assets with a classification level, based on confidentiality, integrity, authenticity and availability requirements, to indicate the protection required according to their sensitivity, criticality, risk and business value;
align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.

3. The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.

Related tasks

Classifying logical information assets

Critical

High

Normal

Low

Data classification

Documentation of other protected assets

Critical

High

Normal

Low

Priority classification of an organization's information assets

Critical

High

Normal

Low

7: Policy and procedures for effectiveness assessment

1. For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken by the relevant entity are effectively implemented and maintained.

2. The policy and procedures referred to in point 7.1 shall take into account results of the risk assessment pursuant to point 2.1 and past significant incidents. The relevant entities shall determine:

what cybersecurity risk-management measures are to be monitored and measured, including processes and controls;
the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;
when the monitoring and measuring is to be performed;
who is responsible for monitoring and measuring the effectiveness of the cybersecurity risk-management measures;
when the results from monitoring and measurement are to be analysed and evaluated;
who has to analyse and evaluate these results.

3. The relevant entities shall review and, where appropriate, update the policy and procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Related tasks

Regular external auditing of security practices

Critical

High

Normal

Low

Risk management

Regular internal monitoring of the implementation of the information security management system

Critical

High

Normal

Low

Risk management

Defining and documenting cyber security metrics

Critical

High

Normal

Low

Executing and documenting internal audits

Critical

High

Normal

Low

Implementation and documentation of management reviews

Critical

High

Normal

Low

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Risk management

3.2.5: Log retention and protection

The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.

Related tasks

Retaining audit logs

Critical

High

Normal

Low

Defining a backup strategy

Critical

High

Normal

Low

Backups

Protecting log information

Critical

High

Normal

Low

3.3: Event reporting

1. The relevant entities shall put in place a simple mechanism allowing their employees, suppliers, and customers to report suspicious events.

2. The relevant entities shall, where appropriate, communicate the event reporting mechanism to their suppliers and customers, and shall regularly train their employees how to use the mechanism.

Related tasks

Defining security events and incidents

Critical

High

Normal

Low

Internal communication in an incident situation

Critical

High

Normal

Low

Process for detecting and reporting security breaches related to the supply chain

Critical

High

Normal

Low

Data breach management

3.2.1: Monitoring and logging procedures

The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.

Related tasks

No items found.

3.1: Incident handling policy

1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.

2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster recovery plan referred to in point 4.1. The policy shall include:

a categorisation system for incidents that is consistent with the event assessment and classification carried out pursuant to point 3.4.1;
effective communication plans including for escalation and reporting;
assignment of roles to detect and appropriately respond to incidents to competent employees;
documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.

3. The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.

Related tasks

Creating and maintaining incident response plans

Critical

High

Normal

Low

Internal communication in an incident situation

Critical

High

Normal

Low

Designation of an incident management team

Critical

High

Normal

Low

Incident management resourcing and monitoring

Critical

High

Normal

Low

Regular testing and review of continuity plans

Critical

High

Normal

Low

Continuity management

Developing an incident response plan for critical information systems

Critical

High

Normal

Low

Continuity management

3.2.7: Review of monitoring and logging procedures

The procedures as well as the list of assets that are being logged shall be reviewed and, where appropriate, updated at regular intervals and after significant incidents.

Related tasks

No items found.

3.4: Event assessment and classification

1. The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.

2. For the purpose of point 3.4.1, the relevant entities shall act in the following manner:

carry out the assessment based on predefined criteria laid down in advance, and on a triage to determine prioritisation of incident containment and eradication;
assess the existence of recurring incidents as referred to in Article 4 of this Regulation on a quarterly basis;
review the appropriate logs for the purposes of event assessment and classification;
put in place a process for log correlation and analysis, and
reassess and reclassify events in case of new information becoming available or after analysis of previously available information.

Related tasks

Classification of incidents

Critical

High

Normal

Low

Regular periodic analysis and learning of incidents

Critical

High

Normal

Low

Data system log review

Critical

High

Normal

Low

Ensuring sorting of cyber security events

Critical

High

Normal

Low

3.6: Post-incident reviews

1. Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from incidents. The post-incident reviews shall identify, where possible, the root cause of the incident and result in documented lessons learned to reduce the occurrence and consequences of future incidents.

2. The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.

3. The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Related tasks

No items found.

3.2.3: Log management and review

Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain, document, and review logs. The relevant entities shall establish a list of assets to be subject to logging based on the results of the risk assessment carried out pursuant to point 2.1. Where appropriate, logs shall include:

relevant outbound and inbound network traffic;
creation, modification or deletion of users of the relevant entities’ network and information systems and extension of the permissions;
access to systems and applications;
authentication-related events;
all privileged access to systems and applications, and activities performed by administrative accounts;
access or changes to critical configuration and backup files;
event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;
use of system resources, as well as their performance;
physical access to facilities;
access to and use of their network equipment and devices;
activation, stopping and pausing of the various logs;
environmental events.

Related tasks

Defining events that need to be logged

Critical

High

Normal

Low

Logging and review of admin and security logs

Critical

High

Normal

Low

Deployment and regular analysis of security system logs

Critical

High

Normal

Low

Data system log review

Critical

High

Normal

Low

Documentation of system logs for self-maintained data systems

Critical

High

Normal

Low

Collection of log data on the use of data systems

Critical

High

Normal

Low

Process for identifying and responding to system log faults

Critical

High

Normal

Low

3.2.6: Log correlation, redundancy and system availability

To the extent feasible, the relevant entities shall ensure that all systems have synchronised time sources to be able to correlate logs between systems for event assessment. The relevant entities shall establish and keep a list of all assets that are being logged and ensure that monitoring and logging systems are redundant. The availability of the monitoring and logging systems shall be monitored independent of the systems they are monitoring.

Related tasks

Temporal information for all system and security logs

Critical

High

Normal

Low

Collection of logs from all assets

Critical

High

Normal

Low

Network usage log and process for detecting inappropriate network traffic

Critical

High

Normal

Low

Network security

Documentation of other protected assets

Critical

High

Normal

Low

Availability of data systems and procedures to protect their availability

Critical

High

Normal

Low

Data system management

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

3.2.2: Automation and frequency of monitoring

To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.

Related tasks

Reducing false positives and false negatives in security monitoring

Critical

High

Normal

Low

Definition and monitoring of alarm policies

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

3.2.4: Alarm thresholds and response

The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically. The relevant entities shall ensure that, in case of an alarm, a qualified and appropriate response is initiated in a timely manner.

Related tasks

Prioritization of security alerts

Critical

High

Normal

Low

Definition and monitoring of alarm policies

Critical

High

Normal

Low

Data system log review

Critical

High

Normal

Low