NIS2

Adopt a security policy for your network and information systems, approved by the management body and dated. The policy sets your approach and objectives, commits to keep improving and to provide the people, money, processes, tools and technology to carry it out, names the documentation to keep and for how long, lists the topic-specific policies, and defines indicators that track how mature your security is. Tell staff and relevant outside parties about it. Review it at least once a year and after significant incidents or changes, and record the result. Assign security roles, responsibilities and authorities to match your needs, tell the management body who holds them, have at least one person report to it directly, separate conflicting duties, require staff and third parties to follow the policy, and review the assignments on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Keep a risk management framework for the security of your network and information systems. Follow a risk method, set your risk tolerance and criteria, identify and document risks across all hazards (third parties and weak points included), analyse them for threat, likelihood, impact and level using threat and vulnerability intelligence, evaluate them against the criteria, prioritise treatment, name who treats each risk and by when, and record the choices and the reasons for accepting residual risk in a risk treatment plan. The management body, or the people with authority to manage risk, accepts the results. Review the assessment and the plan at least once a year and after significant changes or incidents. Check compliance with your own policies, rules and standards regularly, report it to the management body, and have an independent review of your security approach, carried out by people with audit competence who are not under the authority of the area they review, on a schedule and after significant incidents or changes. Report the results to the management body and act on them or accept the risk. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Have an incident handling policy that sets roles, responsibilities and procedures to detect, analyse, contain, respond to, recover from, document and report incidents, in line with your continuity plan. It covers an incident classification system, communication and escalation plans, assigned and competent staff, and playbooks, escalation charts, contact lists and templates. Monitor your systems with tools and procedures, automated where feasible, keep reviewed logs of the assets you choose by risk (network traffic, user and privilege changes, access, authentication, privileged activity, critical configuration and backup files, security tool events, system use, physical access, network equipment, log switching, and environmental events), set alert thresholds, protect the logs and keep them for a set period, and synchronise clocks and keep logging redundant. Give staff, suppliers and customers a simple way to report suspicious events. Assess and classify events, respond promptly in documented phases (containment, elimination, recovery), set communication plans with the CSIRT or competent authority and with internal and outside stakeholders, record the response and the evidence, test the procedures, and review each incident afterwards for root cause and lessons. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Keep a business continuity and disaster recovery plan, based on your risk assessment, that sets purpose, scope, roles, contacts, activation and deactivation conditions, recovery plans and objectives, the resources needed and the return to normal. Run a business impact analysis and set continuity requirements for your systems. Test and update the plans on a schedule and after significant incidents or changes. Keep backups with backup plans covering recovery times, complete and accurate copies (configuration and cloud data included), storage at a safe, separate location, access controls, restoration, and retention. Check backup integrity regularly, keep at least partial redundancy of systems, assets, people and communication channels, and test restores and redundancy and record the results. Run a crisis management process covering roles, communication with the competent authorities, and security measures during a crisis, handle information received from the CSIRT or authority, and test and update the crisis plan. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Set a supply chain security policy for your relations with direct suppliers and service providers, including your own role in the chain, to reduce the identified risks. Set criteria for choosing and contracting suppliers: their cybersecurity and secure development practices, their ability to meet your requirements, the quality and resilience of their products and services, and your ability to diversify and avoid lock-in. Take into account the results of coordinated risk assessments of critical supply chains. Specify in contracts, where fitting through service level agreements, the cybersecurity requirements, awareness and training requirements, background checks of supplier staff, a duty to report incidents without delay, audit or audit report rights, a duty to fix vulnerabilities, subcontracting rules, and obligations at the end of the contract. Apply the same elements when you select suppliers and procure. Review the policy and watch, assess and act on changes in supplier practices on a schedule and after significant changes or incidents. Keep a register of direct suppliers and service providers with a contact point and the ICT products, services and processes each one supplies. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Manage the risks of acquiring ICT services and products that are critical to your systems, through their whole life cycle: set security requirements, update or replacement requirements, information on components and security functions, assurance, and validation of what is delivered. Set secure development rules for in-house and outsourced development covering every stage, with security requirements analysis, secure engineering and coding principles, secure development environments, security testing, and protected, sanitised test data. Set, document and maintain secure configurations of hardware, software, services and networks. Use change management for releases, changes and emergency changes, documenting and testing them against risk first. Keep a security testing policy with a documented method and recorded results, and a patch policy: apply patches within a reasonable time, test them, take them from trusted sources, and document any decision not to patch. Protect the network (documented architecture, access and communication controls, remote access, secure channels, secure transition to current protocols, email standards, DNS and routing hygiene), segment networks and zones by risk and separate production from development, protect against malicious and unauthorised software, and handle vulnerabilities: monitor information, scan, fix critical ones without delay, and set a disclosure procedure. Review each of these on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Set a policy and procedures to assess whether your cybersecurity risk-management measures are carried out and kept effective. Base them on your risk assessment and on past significant incidents. Decide which measures, processes and controls you monitor and measure, the methods that give valid results, when to measure, who measures, when the results are analysed and evaluated, and who does that. Review and update the policy and procedures on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Make sure staff, the management body and direct suppliers and service providers know the risks, understand why cybersecurity matters, and follow cyber hygiene practices. Run a recurring awareness programme that follows your security policies, covers relevant threats, your measures, contact points and further guidance, and user hygiene practices, test whether it works, and keep it current. Identify the staff whose duties need security skills, and give them a training programme matched to their roles that covers secure configuration and operation of systems (mobile devices included), known cyber threats, and what to do when a security event occurs. Assess how effective the training is, train staff who move to roles needing security skills, and update and repeat the programme. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Set and apply a cryptography policy and procedures so that cryptography protects the confidentiality, authenticity and integrity of data in line with the asset classification and your risk assessment. Decide the type, strength and quality of cryptographic measures for data at rest and in transit, the approved protocols, algorithms, key lengths and solutions (with crypto-agility where fitting), and your key management: generating keys, issuing and obtaining certificates, distributing, activating, storing, changing, handling compromised keys, revoking, backing up and archiving, destroying and logging key activity, and activation and deactivation dates. Review the policy and procedures on a schedule against the state of the art. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Make sure staff and direct suppliers understand and accept their security responsibilities, follow the standard cyber hygiene practices, and that privileged users, and management body members, know and keep to their roles. Hire qualified people with reference checks, screening, certificate validation or written tests. Review staff assignments to security roles at least once a year. Where necessary for the role, verify the background of staff and of direct suppliers before they take up duties, with criteria for the roles that need it. Write down in contracts the security duties that continue after the employment ends or changes, such as confidentiality. Keep a disciplinary process for breaches of the security policy, communicate it, and review it on a schedule and after legal changes or major changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Document and apply a logical and physical access control policy for your network and information systems, covering people (staff, visitors and outside parties) and systems, and granting access only to authenticated users. Give, change, remove and document access rights by need-to-know, least privilege and separation of duties, adjust them when people change or leave jobs, limit third-party access in scope and duration, keep a register and log changes, and review the rights on a schedule. Set a policy for privileged and system administration accounts with strong identification, authentication such as multi-factor authentication, and authorisation, dedicated administration accounts, minimal and individual privileges, and review. Limit and control administration systems. Manage the whole identity life cycle with unique identities tied to one person, allow shared identities only with approval and documentation, review identities and deactivate those no longer needed, and log identity management. Apply secure authentication matched to the asset classification, handle secret authentication information confidentially, require changes and resets, lock after failed attempts, end idle sessions, and use multi-factor or continuous authentication where fitting. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Set classification levels for all assets, information included, link each asset to a level by its confidentiality, integrity, authenticity and availability needs, align availability needs with your recovery objectives, and review the levels periodically. Set and communicate a policy for handling assets over their whole life (acquisition, use, storage, transport and disposal), including secure transfer and irreversible deletion. Set a removable media policy with a technical ban unless there is an organisational reason, scanning of media, protection of portable storage in transit and at rest, and cryptography where fitting. Keep a complete, accurate, current and consistent inventory of assets, covering operations and services and the systems and assets that support them, with traceable changes, reviewed regularly. Make sure assets held by staff are handed in, returned or removed when employment ends, and documented, and cut off access of any asset that cannot be recovered. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Prevent loss, damage or compromise of your systems, and interruption of your operations, from failure of supporting utilities such as power, telecommunications, water, gas, sewage and climate control. Where fitting, protect installations against outages, use redundancy, protect power and telecommunications cabling from interception and damage, monitor the utilities and report events beyond set thresholds, contract emergency supply such as generator fuel, and keep the power, temperature, humidity and connectivity systems effective, monitored, maintained and tested. Prevent or limit the effect of physical and environmental threats such as natural disasters, with protective measures, minimum and maximum control thresholds, and monitoring of environmental parameters. Prevent and monitor unauthorised physical access to, damage to and interference with your systems: set security perimeters from your risk assessment, protect them with access controls and entry points, design the physical security of offices, rooms and facilities, and monitor premises for unauthorised access. Test, review and update these protections regularly and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.