Duty of care

Catalog reference

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent incidents or limit their effect on the recipients of your services and on other services (article 21(1)). The measures give a security level matched to those risks. Take account of the state of the art, the cost of implementation and, where applicable, the relevant European and international standards; for proportionality weigh your exposure to risk, your size, and the likelihood and severity of incidents, including their social and economic effect (article 21(2)). The measures follow an all-hazards approach that protects the systems and their physical environment, and cover at least: risk analysis and information system security policy; incident handling; business continuity, such as backup management, recovery plans and crisis management; supply chain security, including your direct suppliers and service providers; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; policies and procedures to assess whether the measures work; basic cyber hygiene and cybersecurity training; policy and procedures on cryptography and, where relevant, encryption; human resources security, access policy and asset management; and, where appropriate, multi-factor or continuous authentication, secured voice, video and text communication and secured emergency communication (article 21(3)). For the supply chain, weigh each direct supplier's specific vulnerabilities, the general quality of their products and their cybersecurity practices including secure development, and the results of the coordinated security risk assessments of critical supply chains that the NIS Cooperation Group runs (article 21(4)). The Cyberbeveiligingsbesluit sets the detailed measures by article 21(5); they are the Requirements Cyberbeveiligingsbesluit art. 6 to art. 18 of this catalog, and an entity takes at least those (Cyberbeveiligingsbesluit art. 5). Government bodies meet the measures through ISO 27001 and the BIO2 government measures: the Cyberbeveiligingsregeling sector overheid (BWBR0052963, arts. 3 and 5) requires an essential entity in the government sector, except a waterschap, to use at least the ISO 27002:2022 controls (except 5.32 and 5.34) and the BIO2 government measures that are relevant to it (except 5.32.01 to 5.34.01), and lets it swap in or combine controls from another framework only at an equivalent level that it can show. The Cyberbeveiligingsregeling IenW (BWBR0052878, arts. 6 to 8) says the same for waterschappen.

Narrative — how we satisfy this requirement