Implementing rules for the application of NIS2 Directive as regards technical and methodological requirements of cybersecurity risk-management measures
- POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS
1.1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS
1.2 ROLES, RESPONSIBILITIES AND AUTHORITIES - RISK MANAGEMENT POLICY
2.1 RISK MANAGEMENT FRAMEWORK
2.2 COMPLIANCE MONITORING
2.3 INDEPENDENT REVIEW OF INFORMATION AND NETWORK SECURITY - INCIDENT HANDLING
3.1 INCIDENT HANDLING POLICY
3.2 MONITORING AND LOGGING
3.3 EVENT REPORTING
3.4 EVENT ASSESSMENT AND CLASSIFICATION
3.5 INCIDENT RESPONSE
3.6 POST-INCIDENT REVIEWS - BUSINESS CONTINUITY AND CRISIS MANAGEMENT
4.1 BUSINESS CONTINUITY AND DISASTER RECOVERY PLAN
4.2 BACKUP AND REDUNDANCY MANAGEMENT
4.3 CRISIS MANAGEMENT - SUPPLY CHAIN SECURITY
5.1 SUPPLY CHAIN SECURITY POLICY
5.2 DIRECTORY OF SUPPLIERS AND SERVICE PROVIDERS - SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE
6.1 SECURITY IN ACQUISITION OF ICT SERVICES OR ICT PRODUCTS
6.2 SECURE DEVELOPMENT LIFE CYCLE
6.3 CONFIGURATION MANAGEMENT
6.4 CHANGE MANAGEMENT, REPAIRS AND MAINTENANCE
6.5 SECURITY TESTING
6.6 SECURITY PATCH MANAGEMENT
6.7 NETWORK SECURITY
6.8 NETWORK SEGMENTATION
6.9 PROTECTION AGAINST MALICIOUS AND UNAUTHORISED SOFTWARE
6.10 VULNERABILITY HANDLING AND DISCLOSURE - POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES
- BASIC CYBER HYGIENE PRACTICES AND SECURITY TRAINING
8.1 AWARENESS RAISING AND BASIC CYBER HYGIENE PRACTICES
8.2 SECURITY TRAINING - CRYPTOGRAPHY
- HUMAN RESOURCES SECURITY
10.1 HUMAN RESOURCES SECURITY
10.2 VERIFICATION OF BACKGROUND
10.3 TERMINATION OR CHANGE OF EMPLOYMENT PROCEDURES
10.4 DISCIPLINARY PROCESS - ACCESS CONTROL
11.1 ACCESS CONTROL POLICY
11.2 MANAGEMENT OF ACCESS RIGHTS
11.3 PRIVILEGED ACCOUNTS AND SYSTEM ADMINISTRATION ACCOUNTS
11.4 ADMINISTRATION SYSTEMS
11.5 IDENTIFICATION
11.6 AUTHENTICATION
11.7 MULTI-FACTOR AUTHENTICATION - ASSET MANAGEMENT
12.1 ASSET CLASSIFICATION
12.2 HANDLING OF ASSETS
12.3 REMOVABLE MEDIA POLICY
12.4 ASSET INVENTORY
12.5 DEPOSIT, RETURN OR DELETION OF ASSETS UPON TERMINATION OF EMPLOYMENT - ENVIRONMENTAL AND PHYSICAL SECURITY
13.1 SUPPORTING UTILITIES
13.2 PROTECTION AGAINST PHYSICAL AND ENVIRONMENTAL THREATS
13.3 PERIMETER AND PHYSICAL ACCESS CONTROL
Source: ENISA