The NIS2 Directive defines specific requirements for cybersecurity risk management policies in order to standardize and strengthen cybersecurity practices throughout the EU. These requirements apply to entities classified as “essential” or “important” based on their role, size, and overall impact on vital sectors and services. To better understand the scope of application, it is useful to start from the main objective of the NIS2 Directive and who is included in the list of NIS2 subjects managed by ACN.

Key Elements of Cybersecurity Risk Management Policies

The NIS2 Directive requires companies to implement a risk-based approach to cybersecurity, going beyond simple regulatory compliance to promote a culture of proactive risk mitigation.

To achieve this goal, the directive includes a list of ten key elements that must be addressed within these risk management policies:

• Risk Analysis and Security Policies: Companies must establish systematic processes to identify, analyze, and document cybersecurity risks specific to their operations and the services they offer. This should include regular review and updating of security policies to address emerging threats and vulnerabilities.
• Incident Management: Clear procedures for managing cybersecurity incidents are essential, emphasizing a rapid and effective response to minimize disruptions and potential damage. This includes establishing communication channels, escalation paths, and processes for reporting, analyzing, containing, and eradicating incidents.
• Business Continuity and Crisis Management: Entities must establish plans to ensure business continuity in the event of disruptions caused by cybersecurity incidents. This includes measures such as backup and disaster recovery procedures, as well as strategies for crisis management and communication during such events.
• Supply Chain Security: NIS2 emphasizes the importance of addressing cybersecurity risks within supply chains, recognizing their increasingly interconnected nature. Companies are required to assess and manage risks associated with their suppliers and service providers, taking into account factors such as security practices and the overall cybersecurity posture of these external entities.
• Secure Acquisition, Development, and Maintenance: Policies must include secure development lifecycles for internal systems and guidelines for the acquisition of third-party systems. This includes vulnerability management processes to identify, assess, correct, and mitigate software and hardware vulnerabilities throughout their lifecycle.
• Effectiveness Assessment: Regular and systematic assessments of the effectiveness of cybersecurity risk management measures are fundamental to ensuring their adequacy in the face of evolving threats. This involves conducting periodic reviews, audits, and exercises to evaluate the performance of implemented security controls and identify areas for improvement.
• Basic Cyber Hygiene and Training: It is essential to establish and promote basic cybersecurity practices for employees and users. This includes applying strong password policies, implementing access controls, promoting safe browsing habits, and increasing awareness regarding common cybersecurity threats such as phishing and social engineering attacks.
• Use of Cryptography: Protecting sensitive data in transit and at rest is crucial. The directive mandates the use of cryptography and, where appropriate, encryption to ensure data confidentiality and integrity. This may include implementing secure communication protocols, encrypting sensitive data stores, and using digital signatures for authentication and non-repudiation.
• Human Resources Security and Access Control: Policies should cover background checks for employees, particularly those in sensitive positions, and the implementation of robust access controls to prevent unauthorized access to critical systems and data. This includes the use of strong authentication mechanisms, limiting user privileges based on the principle of least privilege, and implementing multi-factor authentication where appropriate.
• Secure Communication Systems: Using secure communication channels, particularly for internal communication and incident response, is fundamental to protecting sensitive information from unauthorized access and interception. This includes the use of secure messaging platforms, encrypted email, voice and video conferencing systems, and dedicated emergency communication systems that are resilient and protected from compromise.

Application and Role of Management

The directive emphasizes the responsibility of management regarding cybersecurity, requiring their approval and oversight in the implementation of cybersecurity risk management measures. This includes ensuring that adequate resources are allocated to cybersecurity and promoting a culture of cybersecurity awareness throughout the organization.

These requirements reflect a shift toward more proactive and comprehensive risk management practices, recognizing the evolving nature of cyber threats and the interconnectedness of critical infrastructure and services. By focusing on these key elements, NIS2 aims to establish a higher baseline level of cybersecurity across the EU, strengthening the resilience of essential services and the digital economy as a whole. For organizations that need to structure or verify their compliance journey, the NIS2 Directive compliance support offered by ISGroup covers the entire cycle: from the initial assessment to the implementation of the required measures. The official text of the NIS2 Directive remains the starting regulatory reference for any requirements analysis.