Compliance with the NIS 2 Directive

NIS 2 extends the scope of the legislation to more sectors, such as energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructures, ICT service management, public administration and space.

Perhaps the most relevant aspect is addressed in Article 21 of EU Directive 2022/2555, entitled Cybersecurity risk management measures, which are based on a multi-risk approach aimed at protecting networks and information systems and their physical environment from incidents and include at least the following elements:

• information systems security policy and risk analysis
• incident management
• business continuity, such as backup management and disaster recovery, and crisis management
• supply chain security, including security aspects relating to the relationship between each entity and its direct suppliers or service providers
• security of procurement, development and maintenance of computer and network systems, including vulnerability management and disclosure
• strategies and procedures for assessing the effectiveness of cyber security risk management measures
• basic cyber hygiene practices and cyber security training
• policies and procedures relating to the use of encryption and, where appropriate, scrambling; human resources security, strategies and procedures for assessing the effectiveness of cyber security risk management measures; basic cyber hygiene practices and cyber security training
• human resources security, access control strategies and asset management
• use of multi-factor or continuous authentication solutions; secure voice, video and text communications; and secure internal emergency communication systems, where appropriate.