NIS2 Guide

8.1: Awareness raising and basic cyber hygiene practices

1. For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities shall ensure that their employees, including members of management bodies, as well as direct suppliers and service providers are aware of risks, are informed of the importance of cybersecurity and apply cyber hygiene practices.

2. For the purpose of point 8.1.1, the relevant entities shall offer to their employees, including members of management bodies, as well as to direct suppliers and service providers where appropriate in accordance with point 5.1.4, an awareness raising programme, which shall:

be scheduled over time, so that the activities are repeated and cover new employees;
be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security;
cover relevant cyber threats, the cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.

3. The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.

Related tasks

Security agreement with a supplier

Critical

High

Normal

Low

Supplier security

Regular unit-based cyber security communication

Critical

High

Normal

Low

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

Management commitment to cyber security management and management system

Critical

High

Normal

Low

General security competence and awareness of personnel

Critical

High

Normal

Low

Staff awareness of continuity plans

Critical

High

Normal

Low

8.2: Security training

1. The relevant entities shall identify employees, whose roles require security relevant skill sets and expertise, and ensure that they receive regular training on network and information system security.

2. The relevant entities shall establish, implement and apply a training program in line with the network and information security policy, topic-specific policies and other relevant procedures on network and information security which lays down the training needs for certain roles and positions based on criteria.

3. The training referred to in point 8.2.1 shall be relevant to the job function of the employee and its effectiveness shall be assessed. Training shall take into consideration security measures in place and cover the following:

instructions regarding the secure configuration and operation of the network and information systems, including mobile devices;
briefing on known cyber threats;
training of the behaviour when security-relevant events occur.

4. The relevant entities shall apply training to staff members who transfer to new positions or roles which require security relevant skill sets and expertise.

5. The program shall be updated and run periodically taking into account applicable policies and rules, assigned roles, responsibilities, as well as known cyber threats and technological developments.

Related tasks

Regular review of staff training themes

Critical

High

Normal

Low

Ensuring coverage of relevant topics on personnel training and guidance processes

Critical

High

Normal

Low

Evaluating the efficiency of arranged training

Critical

High

Normal

Low

Arranging training and guidance during orientation (or before granting access rights)

Critical

High

Normal

Low

Staff guidance and training procedure in cyber security

Critical

High

Normal

Low

Amount, competence and adequacy of key cyber security personnel

Critical

High

Normal

Low

4.1.3: Business impact analysis

The relevant entities shall carry out a business impact analysis to assess the potential impact of severe disruptions to their business operations and shall, based on the results of the business impact analysis, establish continuity requirements for the network and information systems.

Related tasks

Conducting business impact analysis

Critical

High

Normal

Low

4.2.5: Monitoring and adjusting resources for redundancy

Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources, including facilities, systems and personnel, is duly informed by backup and redundancy requirements.

Related tasks

Testing switching to backup and redundant infrastructure

Critical

High

Normal

Low

Equipment maintenance and safety

System capacity planning and resilience

Critical

High

Normal

Low

Data system management

Setting up and resourcing backup equipment

Critical

High

Normal

Low

4.3: Crisis management

1. The relevant entities shall put in place a process for crisis management.

2. The relevant entities shall ensure that the crisis management process addresses at least the following elements:

roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;
appropriate communication means between the relevant entities and relevant competent authorities;
application of appropriate measures to ensure the maintenance of network and information system security in crisis situations.

For the purpose of point (b), the flow of information between the relevant entities and relevant competent authorities shall include both obligatory communications, such as incident reports and related timelines, and non- obligatory communications.

3. The relevant entities shall implement a process for managing and making use of information received from the CSIRTs or, where applicable, the competent authorities, concerning incidents, vulnerabilities, threats or possible mitigation measures.

4. The relevant entities shall test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks.

Related tasks

Management and use of information received from CSIRTs and competent authorities

Critical

High

Normal

Low

Including suppliers in incident management

Critical

High

Normal

Low

Internal communication in an incident situation

Critical

High

Normal

Low

Establishing a crisis management team and process

Critical

High

Normal

Low

Maintaining chosen theme-specific policy documents

Critical

High

Normal

Low

4.2.1: Backup and redundancy requirements

The relevant entities shall maintain backup copies of data and provide sufficient available resources, including facilities, network and information systems and staff, to ensure an appropriate level of redundancy.

Related tasks

System capacity planning and resilience

Critical

High

Normal

Low

Data system management

Defining a backup strategy

Critical

High

Normal

Low

Documenting and delegating ownership of own backup processes

Critical

High

Normal

Low

Determining responsibilities for backing up important information assets

Critical

High

Normal

Low

4.2.3: Verification of backup integrity

The relevant entities shall perform regular integrity checks on the backup copies.

Related tasks

No items found.

4.1.1: Business continuity and disaster recovery plan

For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.

Related tasks

Creating and documenting continuity plans

Critical

High

Normal

Low

Regular testing and review of continuity plans

Critical

High

Normal

Low

4.2.2: Backup planning and implementation

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall lay down backup plans which include the following:

recovery times;
assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;
storing backup copies (online or offline) in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site;
appropriate physical and logical access controls to backup copies, in accordance with the asset classification level;
restoring data from backup copies;
retention periods based on business and regulatory requirements.

Related tasks

Developing and executing a recovery plan

Critical

High

Normal

Low

Regular testing, evaluation, and recovery instructions for backups

Critical

High

Normal

Low

Defining a backup strategy

Critical

High

Normal

Low

Processing principles and accountability

Defining and documenting retention times for data sets

Critical

High

Normal

Low

Archiving and destruction processes for data sets

Critical

High

Normal

Low

Management of data sets

4.2.6: Testing of backup and recovery processes

The relevant entities shall carry out regular testing of the recovery of backup copies and redundancies to ensure that, in recovery conditions, they can be relied upon and cover the copies, processes and knowledge to perform an effective recovery. The relevant entities shall document the results of the tests and, where needed, take corrective action.

Related tasks

Testing switching to backup and redundant infrastructure

Critical

High

Normal

Low

Regular testing, evaluation, and recovery instructions for backups

Critical

High

Normal

Low

4.1.2: Restoration and recovery procedures

The relevant entities’ operations shall be restored according to the business continuity and disaster recovery plan. The plan shall be based on the results of the risk assessment carried out pursuant to point 2.1 and shall include, where appropriate, the following:

purpose, scope and audience;
roles and responsibilities;
key contacts and (internal and external) communication channels;
conditions for plan activation and deactivation;
order of recovery for operations;
recovery plans for specific operations, including recovery objectives;
required resources, including backups and redundancies;
restoring and resuming activities from temporary measures.

Related tasks

Defining criteria for activation and deactivation of continuity plans

Critical

High

Normal

Low

Developing and executing a recovery plan

Critical

High

Normal

Low

Creating and documenting continuity plans

Critical

High

Normal

Low

Defining a backup strategy

Critical

High

Normal

Low

Determining responsibilities for backing up important information assets

Critical

High

Normal

Low

Consideration of risk management results in continuity planning

Critical

High

Normal

Low

Risk management

Communication to stakeholders on continuity plans

Critical

High

Normal

Low

4.2.4: Availability and redundancy of resources

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall ensure sufficient availability of resources by at least partial redundancy of the following:

network and information systems;
assets, including facilities, equipment and supplies;
personnel with the necessary responsibility, authority and competence;
appropriate communication channels.

Related tasks

Ensuring communication availability during security events

Critical

High

Normal

Low

Assessment of facility redundancy for service delivery

Critical

High

Normal

Low

System capacity planning and resilience

Critical

High

Normal

Low

Data system management

4.1.4: Testing, review and update of continuity plans

The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.

Related tasks

No items found.

1.1: The network and information system security policy

1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall:

set out the relevant entities’ approach to managing the security of their network and information systems;
be appropriate to and complementary with the relevant entities’ business strategy and objectives;
set out network and information security objectives;
include a commitment to continual improvement of the security of network and information systems;
include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies;
be communicated to and acknowledged by relevant employees and relevant interested external parties;
lay down roles and responsibilities pursuant to point 1.2;
list the documentation to be kept and the duration of retention of the documentation;
list the topic-specific policies;
lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security;
indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).

2. The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.

Related tasks

Information security policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Defining security roles and responsibilities

Critical

High

Normal

Low

Cyber security in contracts

Formal adoption of security policies

Critical

High

Normal

Low

Management commitment to cyber security management and management system

Critical

High

Normal

Low

Implementation and documentation of management reviews

Critical

High

Normal

Low

1.2: Roles, responsibilities and authorities

1. As part of their policy on the security of network and information systems referred to in point 1.1, the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities’ needs, and communicate them to the management bodies.

2. The relevant entities shall require all personnel and third parties to apply network and information system security in accordance with the established network and information security policy, topic-specific policies and procedures of the relevant entities.

3. At least one person shall report directly to the management bodies on matters of network and information system security.

4. Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.

5. Conflicting duties and conflicting areas of responsibility shall be segregated, where applicable.

6. Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by management bodies at planned intervals and when significant incidents or significant changes to operations or risks occur.

Related tasks

Defining security roles and responsibilities

Critical

High

Normal

Low

Segregation of information security related duties

Critical

High

Normal

Low