Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements

NIS2-IMPL-1.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §1.1

Network and information system security policy — required content and review

Maintain a single approved network-and-information-system security policy that sets out the entity's security approach, aligns with business strategy, states security objectives, commits to continual improvement and adequate resourcing, is communicated to staff and relevant external parties, lays down roles per §1.2, lists retained documentation and topic-specific policies, sets monitoring indicators, and is dated with management-body approval — reviewed at least annually or after a significant incident or change.

NIS2-IMPL-1.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §1.2

Roles, responsibilities and authorities for network and information system security

Assign and communicate network-and-information-system security responsibilities and authorities; require personnel and third parties to follow the security policy; ensure at least one person reports directly to the management body on security matters; size-appropriate dedicated or combined roles; segregate conflicting duties where applicable; review roles at planned intervals or after significant change.

NIS2-IMPL-10.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §10.1

Human resources security responsibilities

Ensure employees and, where applicable per §5.1.4, direct suppliers and service providers understand and commit to their security responsibilities, appropriate to their role and service and in line with the N&IS security policy — via mechanisms ensuring standard cyber hygiene practices (§8.1) are understood and followed, administrative/privileged users act per their roles/responsibilities/authorities, management body members understand and act on their N&IS security role, and qualified personnel are hired for security-relevant roles (e.g. reference checks, vetting, certification validation, written tests). Personnel role assignments (per §1.2) and resourcing are reviewed at planned intervals and at least annually, updated where necessary.

NIS2-IMPL-10.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §10.2

Background verification

To the extent feasible, verify the background of employees and, where applicable per §5.1.4, direct suppliers and service providers, where necessary for their role, responsibilities and authorisations — by setting criteria for which roles require verified backgrounds, and performing that verification before the person starts exercising the role, taking into account applicable laws, regulations and ethics, proportionate to business requirements, the §12.1 asset classification, the systems to be accessed, and perceived risk. The policy is reviewed and, where appropriate, updated at planned intervals.

NIS2-IMPL-10.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §10.3

Termination or change of employment procedures

Ensure network and information system security responsibilities and duties that remain valid after termination or change of an employee's employment are contractually defined and enforced — including confidentiality clauses and similar terms written into the individual's employment terms, contract or agreement.

NIS2-IMPL-10.4 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §10.4

Disciplinary process for security policy violations

Establish, communicate and maintain a disciplinary process for handling violations of network and information system security policies, taking into account relevant legal, statutory, contractual and business requirements. The process is reviewed and, where appropriate, updated at planned intervals and when necessary due to legal changes or significant operational/risk changes.

NIS2-IMPL-11.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.1

Access control policy

Establish, document and implement logical and physical access control policies for network and information systems, based on business and N&IS security requirements — addressing access by persons (staff, visitors, external entities such as suppliers/service providers) and by network and information systems themselves, and ensuring access is only granted to adequately authenticated users. Policies are reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant operational/risk changes.

NIS2-IMPL-11.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.2

Management of access rights

Provide, modify, remove and document access rights to network and information systems in accordance with the §11.1 access control policy — assigning and revoking rights based on need-to-know, least privilege and separation of duties; modifying access upon termination or change of employment; ensuring access is authorised by the relevant persons; appropriately addressing third-party access (visitors, suppliers, service providers) by limiting scope and duration; maintaining a register of granted access rights; and applying logging to access-rights management. Access rights are reviewed at planned intervals, modified based on organisational changes, with review results and necessary changes documented.

NIS2-IMPL-11.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.3

Privileged accounts and system administration accounts

Maintain policies for managing privileged accounts and system administration accounts as part of the §11.1 access control policy — establishing strong identification/authentication (e.g. multi-factor) and authorisation procedures for such accounts; setting up dedicated accounts used exclusively for system administration operations (installation, configuration, management, maintenance); individualising and restricting administration privileges to the highest extent possible; and ensuring administration accounts are only used to connect to system administration systems. Access rights of privileged/administration accounts are reviewed at planned intervals, modified based on organisational changes, with review results documented.

NIS2-IMPL-11.4 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.4

Restriction and control of system administration systems

Restrict and control the use of system administration systems in accordance with the §11.1 access control policy — using them only for system administration purposes and no other operations, logically separating them from application software not used for administration, and protecting access to them through authentication and encryption.

NIS2-IMPL-11.5 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.5

Identity lifecycle management

Manage the full life cycle of identities for network and information systems and their users — setting up unique identities for systems and users, linking each user identity to a single person, ensuring oversight of system identities, and applying logging to identity management. Identities assigned to multiple persons (e.g. shared identities) are only permitted where necessary for business or operational reasons, subject to explicit approval, documentation, and inclusion in the §2.1 risk management framework. Identities are regularly reviewed and deactivated without delay once no longer needed.

NIS2-IMPL-11.6 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §11.6

Authentication procedures and technologies

Implement secure authentication procedures and technologies based on access restrictions and the access control policy — ensuring authentication strength matches the classification of the asset accessed; controlling allocation/management of secret authentication information to preserve confidentiality (including personnel guidance on handling it); requiring credential changes initially, at predefined intervals, and upon suspected compromise; resetting credentials and blocking users after a predefined number of failed login attempts; terminating inactive sessions after a predefined inactivity period; and requiring separate credentials for privileged/administrative access. To the extent feasible, state-of-the-art authentication methods and unique authentication information are used, matched to assessed risk and asset classification. Procedures and technologies are reviewed at planned intervals.

NIS2-IMPL-12.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §12.1

Asset classification

Lay down classification levels for all assets (including information) in scope of network and information systems, indicating the level of protection required — establishing a classification-level system, associating every asset with a level based on confidentiality/integrity/authenticity/availability requirements reflecting sensitivity, criticality, risk and business value, and aligning asset availability requirements with the delivery/recovery objectives set in the §4.1 business continuity/disaster recovery plans. Classification levels are periodically reviewed and updated where appropriate.

NIS2-IMPL-12.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §12.2

Handling of assets

Establish, implement and apply a policy for the proper handling of assets (including information), in line with the N&IS security policy, communicated to anyone who uses or handles assets — covering the entire asset life cycle (acquisition, use, storage, transportation, disposal), providing rules for safe use/storage/transport and irretrievable deletion/destruction, and ensuring secure transfer appropriate to the asset type. Reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant operational/risk changes.

NIS2-IMPL-12.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §12.3

Removable media policy

Establish, implement and apply a policy on managing removable storage media, communicated to employees and third parties who handle such media at the entity's premises or wherever it connects to the entity's network and information systems — technically prohibiting removable-media connection absent an organisational reason, disabling self-execution and scanning media for malicious code before use, controlling/protecting portable storage devices in transit and storage, and, where appropriate, using cryptographic techniques to protect data on removable media. Reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant operational/risk changes.

NIS2-IMPL-12.4 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §12.4

Asset inventory

Develop and maintain a complete, accurate, up-to-date and consistent inventory of assets, with changes to inventory entries recorded traceably. Inventory granularity is appropriate to the entity's needs and includes the list of operations/services and their description, and the list of network and information systems and other associated assets supporting those operations/services. The inventory and its assets are regularly reviewed and updated, with a documented history of changes.

NIS2-IMPL-12.5 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §12.5

Deposit, return or deletion of assets upon termination of employment

Establish, implement and apply procedures ensuring assets under personnel custody are deposited, returned or deleted upon termination of employment, with the deposit/return/deletion documented. Where deposit, return or deletion isn't possible, ensure those assets can no longer access the entity's network and information systems, per §12.2.2.

NIS2-IMPL-13.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §13.1

Protection of supporting utilities

Prevent loss, damage or compromise of network and information systems, or interruption to operations, from failure or disruption of supporting utilities — where appropriate, protecting facilities from power failures and other utility disruptions (electricity, telecommunications, water, gas, sewage, ventilation, air conditioning); considering utility-service redundancy; protecting electricity/telecommunications utility services carrying data or supplying systems against interception and damage; monitoring those services and reporting threshold-breaching events to competent personnel; concluding emergency-supply contracts (e.g. fuel for emergency power); and ensuring continuous effectiveness through monitoring, maintenance and testing of the supply (electricity, temperature/humidity control, telecommunications, Internet connection). Protection measures are tested, reviewed and, where appropriate, updated regularly or after significant incidents or significant operational/risk changes.

NIS2-IMPL-13.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §13.2

Protection against physical and environmental threats

Prevent or reduce the consequences of events from physical and environmental threats (natural disasters and other intentional or unintentional threats), based on the §2.1 risk assessment — where appropriate, designing and implementing protection measures, determining minimum/maximum control thresholds for physical/environmental threats, and monitoring environmental parameters with reporting to competent personnel on threshold breaches. Protection measures are tested, reviewed and, where appropriate, updated regularly or after significant incidents or significant operational/risk changes.

NIS2-IMPL-13.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §13.3

Perimeter and physical access control

Prevent and monitor unauthorised physical access, damage and interference to network and information systems — laying down and using risk-assessment-based security perimeters to protect areas housing systems and associated assets; protecting those areas with appropriate entry controls and access points; designing and implementing physical security for offices, rooms and facilities; and continuously monitoring premises for unauthorised physical access. Physical access control measures are tested, reviewed and, where appropriate, updated regularly or after significant incidents or significant operational/risk changes.

NIS2-IMPL-2.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §2.1

Risk management framework and cybersecurity risk management process

Establish and maintain a risk management framework and a documented cybersecurity risk management process — following a defined methodology, risk tolerance and risk criteria, identifying risks with an all-hazards approach (including third-party and single-point-of-failure risk), analysing and evaluating them, prioritising and monitoring treatment, and documenting the risk treatment plan with justified residual-risk acceptance — reviewed at least annually or after significant change.

NIS2-IMPL-2.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §2.2

Compliance monitoring

Regularly review compliance with the security policy, topic-specific policies, rules and standards, and inform the management body of the current security status through regular reporting via an effective compliance reporting system, at planned intervals or after significant incidents/changes.

NIS2-IMPL-2.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §2.3

Independent review of network and information system security

Independently review the approach to managing network-and-information-system security (people, processes, technology), carried out by reviewers with appropriate audit competence who are impartial and outside the line of authority of the area reviewed (or via alternative safeguards where the entity is too small for that separation), at planned intervals or after significant incidents/changes, with results — including compliance-monitoring and measurement output — reported to the management body.

NIS2-IMPL-3.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.1

Incident handling policy — roles, responsibilities and procedures

Establish and implement an incident handling policy that lays down roles, responsibilities and procedures for detecting, analysing, containing, responding to, recovering from, documenting and reporting incidents in a timely manner. The policy must be coherent with the business continuity and disaster recovery plan (§4.1), and include an incident categorisation system consistent with event assessment (§3.4.1), effective communication/escalation/reporting plans, role assignments to competent employees, and supporting documents (response manuals, escalation charts, contact lists, templates) — tested, reviewed and, where appropriate, updated at planned intervals and after significant incidents or changes.

NIS2-IMPL-3.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.2

Monitoring and logging of network and information systems

Lay down procedures and use tools to monitor and log activity on network and information systems to detect events that could be incidents, minimising false positives/negatives and automating monitoring where feasible. Maintain, document and review logs covering — where appropriate, per the entity's own risk-based asset list — network traffic, user/permission changes, system and application access, authentication events, privileged/admin activity, configuration and backup changes, security-tool logs, resource usage, physical access, network-equipment access, log activation/pausing, and environmental events; reviewed regularly for unusual trends, with alarm thresholds triggering a timely qualified response. Logs must be backed up, protected from unauthorised access/change, time-synchronised across systems, and monitoring/logging systems kept redundant with availability monitored independently.

NIS2-IMPL-3.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.3

Event reporting mechanism for employees, suppliers and customers

Put in place a simple mechanism allowing employees, suppliers and customers to report suspicious events, communicate that mechanism to suppliers and customers where appropriate, and regularly train employees on how to use it.

NIS2-IMPL-3.4 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.4

Event assessment and classification

Assess suspicious events against predefined criteria to determine whether they constitute incidents and, if so, their nature and severity — using triage to prioritise containment/eradication, reviewing relevant logs, correlating and analysing them, assessing recurring incidents on a quarterly basis, and reassessing/reclassifying events as new information becomes available.

NIS2-IMPL-3.5 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.5

Incident response — containment, eradication and recovery

Respond to incidents in a timely manner per documented procedures covering containment (preventing spread), eradication (preventing recurrence) and recovery. Establish communication plans and procedures with CSIRTs/competent authorities for incident notification and for internal/external stakeholder communication during an incident. Log incident response activities and record evidence, and test incident response procedures at planned intervals.

NIS2-IMPL-3.6 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §3.6

Post-incident reviews and lessons learned

Where appropriate, carry out post-incident reviews after recovery to identify the root cause and produce documented lessons learned that reduce the occurrence and consequences of future incidents, feeding improvements back into network/information security, risk treatment, and incident handling/detection/response procedures — reviewing at planned intervals whether incidents led to post-incident reviews.

NIS2-IMPL-4.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §4.1

Business continuity and disaster recovery plan

Lay down and maintain a business continuity and disaster recovery plan for incidents, based on the §2.1 risk assessment, covering purpose/scope/audience, roles and responsibilities, key contacts and communication channels, activation/deactivation conditions, recovery order, per-operation recovery plans with objectives, required resources (backups and redundancies), and restoring/resuming activities from temporary measures. A business impact analysis shall assess the potential impact of severe disruptions and establish continuity requirements for network and information systems. The plan is tested, reviewed and, where appropriate, updated at planned intervals and after significant incidents or changes, incorporating lessons learnt.

NIS2-IMPL-4.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §4.2

Backup and redundancy management

Maintain data backup copies and sufficient redundant resources (facilities, network and information systems, staff). Lay down backup plans covering recovery times, backup completeness/accuracy (including data held in cloud environments), safe offline/online storage at a location distant enough to escape a disaster at the main site, physical/logical access controls matched to asset classification, restoration procedures, and retention periods based on business and regulatory requirements. Perform regular backup integrity checks; ensure at least partial redundancy of systems, assets, personnel and communication channels based on the risk assessment and continuity plan; keep resource monitoring and adjustment informed by backup/redundancy requirements; and regularly test recovery of backups and redundancies, documenting results and taking corrective action where needed.

NIS2-IMPL-4.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §4.3

Crisis management process

Put in place a crisis management process addressing personnel and, where appropriate, supplier/service-provider role allocation with specific steps to follow in crisis situations; appropriate communication channels with relevant competent authorities, covering both obligatory communications (e.g. incident reports and related timelines) and non-obligatory communications; and measures to maintain network and information system security during crises. Implement a process for managing and using information received from CSIRTs or competent authorities about incidents, vulnerabilities, threats or possible mitigation measures. Test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks.

NIS2-IMPL-5.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §5.1

Supply chain security policy — supplier selection, contracts and review

Establish, implement and apply a supply chain security policy governing direct suppliers and service providers to mitigate identified network-and-information-system security risks; identify the entity's own role in the supply chain and communicate it to those suppliers. The policy sets supplier/service-provider selection and contracting criteria — cybersecurity practices (including secure development), ability to meet the entity's cybersecurity specifications, ICT product/service quality, resilience and risk classification, and supply diversification/anti-lock-in where applicable — taking into account any Article 22(1) coordinated supply-chain risk assessments where applicable. Based on the policy and the §2.1 risk assessment, contracts/SLAs specify, where appropriate: cybersecurity requirements (including §6.1 acquisition requirements), supplier-staff awareness/training/certification requirements, background-verification requirements, prompt incident-notification obligations, audit or audit-report rights, vulnerability-handling obligations, subcontracting requirements, and contract-termination obligations (e.g. data retrieval/disposal). These elements feed both new-supplier selection and the §6.1 procurement process; the policy and supplier practice are reviewed, monitored and acted on at planned intervals and after significant operational/risk changes or supplier-related incidents — including regular SLA-report monitoring, incident review, unscheduled-review assessment, and timely risk mitigation for ICT product/service changes.

NIS2-IMPL-5.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §5.2

Directory of suppliers and service providers

Maintain and keep up to date a registry of direct suppliers and service providers, including a contact point for each and a list of the ICT products, ICT services and ICT processes each one provides to the entity.

NIS2-IMPL-6.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.1

Security in acquisition of ICT services and products

Set and implement processes to manage risks stemming from acquiring ICT services or products for components critical to the entity's network and information system security, based on the §2.1 risk assessment, throughout the supplier or service-provider relationship's life cycle. Processes cover: security requirements to apply to acquired ICT services/products; requirements for security updates throughout their lifetime or replacement after end of support; documentation of the hardware/software components used; documentation of implemented cybersecurity functions and the configuration required for secure operation; assurance that the ICT services/products comply with the stated security requirements; and validation methods confirming delivered ICT services/products meet those requirements, with the validation results documented. Reviewed and, where appropriate, updated at planned intervals and when significant incidents occur.

NIS2-IMPL-6.10 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.10

Vulnerability handling and disclosure

Obtain information about technical vulnerabilities in network and information systems, evaluate exposure, and take appropriate management measures: monitor vulnerability information through appropriate channels (CSIRTs, competent authorities, supplier/service-provider information); perform vulnerability scans where appropriate with recorded evidence at planned intervals; address vulnerabilities identified as critical to operations without undue delay; ensure vulnerability handling is compatible with change management, security patch management, risk management and incident management procedures; and lay down a vulnerability-disclosure procedure consistent with the applicable national coordinated vulnerability disclosure policy. Where justified by potential impact, create and implement a mitigation plan; otherwise document and substantiate why remediation isn't required. Monitoring channels are reviewed and, where appropriate, updated at planned intervals.

NIS2-IMPL-6.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.2

Secure development life cycle

Before developing a network and information system (including software), lay down and apply secure-development rules covering all development phases — specification, design, development, implementation and testing — for both in-house and outsourced development. This includes: security-requirements analysis at the specification/design phases of any development or acquisition project; secure-engineering and secure-coding principles such as cybersecurity-by-design and zero-trust architectures; security requirements for development environments; security testing processes within the development life cycle; appropriate selection, protection and management of security test data; and sanitisation/anonymisation of test data per the §2.1 risk assessment. Outsourced development additionally applies the §5 supply-chain and §6.1 acquisition policies/procedures. Rules are reviewed and, where necessary, updated at planned intervals.

NIS2-IMPL-6.3 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.3

Configuration management

Take appropriate measures to establish, document, implement and monitor configurations — including security configurations — of hardware, software, services and networks: laying down and ensuring secure configurations, and laying down and implementing processes/tools to enforce those configurations for newly installed systems and for systems in operation over their lifetime. Configurations are reviewed and, where appropriate, updated at planned intervals or when significant incidents or significant operational/risk changes occur.

NIS2-IMPL-6.4 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.4

Change management, repairs and maintenance

Apply change management procedures — consistent with the entity's general change-management policies where applicable — to control changes to network and information systems, covering releases, modifications and emergency changes to software/hardware in operation and configuration changes; changes must be documented and, based on the §2.1 risk assessment, tested and impact-assessed before implementation. Where an emergency prevents following the regular procedure, the entity documents the change's result and the reason the procedure could not be followed. Procedures are reviewed and, where appropriate, updated at planned intervals and when significant incidents or significant operational/risk changes occur.

NIS2-IMPL-6.5 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.5

Security testing

Establish, implement and apply a security testing policy and procedures: determine the need, scope, frequency and type of security tests based on the §2.1 risk assessment; carry out tests per a documented methodology covering components identified as relevant to secure operation; document the type, scope, time and results of tests including a criticality assessment and mitigating actions per finding; and apply mitigating actions for critical findings. The policy is reviewed and, where appropriate, updated at planned intervals.

NIS2-IMPL-6.6 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.6

Security patch management

Specify and apply patch-management procedures, coherent with change management, vulnerability management, risk management and other relevant procedures, ensuring: security patches are applied within a reasonable time after becoming available; patches are tested before production deployment; patches come from trusted sources and are integrity-checked; and additional measures with residual-risk acceptance apply where a patch is unavailable or not applied. By derogation, an entity may choose not to apply a patch when the disadvantages outweigh the cybersecurity benefits — such a decision must be documented and substantiated.

NIS2-IMPL-6.7 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.7

Network security

Take appropriate measures to protect network and information systems from cyber threats: document the network architecture in a comprehensible, up-to-date manner; determine and apply controls protecting internal network domains from unauthorised access; configure controls preventing unnecessary access/communication; determine and apply remote-access controls, including for service providers; keep security-policy administration systems separate from other uses; forbid or deactivate unneeded connections and services; where appropriate, restrict network access to authorised devices; allow service-provider connections only via time-boxed authorisation requests; use trusted, isolated channels (logical, cryptographic or physical separation with assured endpoint identification and protection from modification/disclosure) between distinct systems; adopt and accelerate an implementation plan for transitioning to latest-generation network-layer protocols; adopt and accelerate an implementation plan for modern, interoperable secure e-mail communication standards; and apply DNS security and Internet routing security/hygiene best practices. Measures are reviewed and, where appropriate, updated at planned intervals and after significant incidents or changes.

NIS2-IMPL-6.8 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.8

Network segmentation

Segment systems into networks or zones per the §2.1 risk assessment, and segment the entity's own systems/networks from third parties' systems/networks — considering the functional, logical and physical relationship (including location) between trustworthy systems/services; granting zone access based on an assessment of security requirements; keeping operation- or safety-critical systems in secured zones; deploying a demilitarised zone for communications originating from or destined to the entity's networks; restricting inter/intra-zone access and communication to what's necessary for operation or safety; separating the network-administration network from the operational network; segregating network-administration channels from other traffic; and separating production systems (including backups) from development/testing systems. Segmentation is reviewed and, where appropriate, updated at planned intervals and after significant incidents or changes.

NIS2-IMPL-6.9 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §6.9

Protection against malicious and unauthorised software

Protect network and information systems against malicious and unauthorised software, in particular by implementing measures that detect or prevent its use — where appropriate, equipping systems with detection-and-response software that is regularly updated per the §2.1 risk assessment and the contractual agreements with providers.

NIS2-IMPL-7 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §7

Effectiveness assessment of cybersecurity risk-management measures

Establish, implement and apply a policy and procedures to assess whether the entity's cybersecurity risk-management measures are effectively implemented and maintained — taking into account the §2.1 risk assessment results and past significant incidents. The policy and procedures determine which measures (including processes and controls) are monitored and measured, the methods for monitoring, measurement, analysis and evaluation to ensure valid results, when monitoring/measuring is performed, who is responsible for it, when results are analysed and evaluated, and who does that analysis. Reviewed and, where appropriate, updated at planned intervals and when significant incidents or significant operational/risk changes occur.

NIS2-IMPL-8.1 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §8.1

Awareness raising and basic cyber hygiene practices

Ensure employees (including members of management bodies) and, where appropriate per §5.1.4, direct suppliers and service providers are aware of risks, informed of the importance of cybersecurity, and apply cyber hygiene practices — via an awareness-raising programme that is scheduled over time to repeat and reach new employees, established in line with the network-and-information-system security policy, topic-specific policies and procedures, and covers relevant cyber threats, the cybersecurity risk-management measures in place, contact points and resources for further advice, and cyber hygiene practices for users. Where appropriate, the programme's effectiveness is tested; it is updated and offered at planned intervals accounting for changes in cyber hygiene practices, the threat landscape and entity-specific risk.

NIS2-IMPL-8.2 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §8.2

Security training for security-relevant roles

Identify employees whose roles require security-relevant skills and expertise, and ensure they receive regular network-and-information-system security training, via a training programme established in line with the N&IS security policy, topic-specific policies and procedures that lays down role-based training needs by criteria. Training must be relevant to the employee's job function, have its effectiveness assessed, account for security measures in place, and cover secure configuration/operation instructions (including mobile devices), known cyber threat briefings, and behaviour during security-relevant events. Training is applied when staff transfer into security-relevant roles, and the programme is updated and run periodically accounting for applicable policies/rules, assigned roles and responsibilities, known threats and technological developments.

NIS2-IMPL-9 · Commission Implementing Regulation (EU) 2024/2690 — NIS2 Art 21(2) technical requirements, Annex §9

Cryptography policy and key management

Establish, implement and apply a policy and procedures on cryptography to ensure adequate and effective use of cryptography protecting the confidentiality, authenticity and integrity of data, in line with asset classification and the §2.1 risk assessment. The policy and procedures establish, per asset classification: the type, strength and quality of cryptographic measures required for data at rest and in transit; the protocols/algorithms, cipher strength, cryptographic solutions and usage practices to approve and require, following a cryptographic agility approach where appropriate; and the entity's key-management approach, covering (where appropriate) key generation, certificate issuance/obtaining, key distribution/activation, key storage/access, key change/update, compromised-key handling, key revocation, lost/corrupted key recovery, key backup/archiving, key destruction, logging/auditing of key-management activity, and key activation/deactivation date-setting. Reviewed and, where appropriate, updated at planned intervals accounting for the state of the art in cryptography.