While the available sources outline the main elements of cybersecurity risk management required by NIS2, including the need for entities to conduct risk assessments, a mandatory frequency for such assessments is not explicitly specified.

Article 21, Paragraph 1: This article, which describes cybersecurity risk management measures, establishes that essential and important entities must take “appropriate and proportionate” measures to manage risks to their network and information systems.
Emphasis on Continuous Risk Management: The language used in Article 21, with phrases such as “appropriate and proportionate,” suggests a continuous and iterative approach to risk management rather than planning based on a fixed calendar.

Insights from Related Provisions and Context

Although the regulation does not indicate a specific frequency, various provisions and contextual factors within NIS2 provide guidance on how often entities should ideally conduct risk assessments:

1. Dynamic Nature of Cyber Threats: The regulation frequently highlights the rapid evolution of the cybersecurity threat landscape. Given the continuous emergence of new threats and vulnerabilities, entities must regularly review their security posture, which implies that risk assessments should occur more frequently than just once.
2. Contextual Changes: An entity’s risk profile can be influenced by a wide range of internal and external changes, including:
   • Business Operations: Expansion into new markets, the adoption of new technologies, changes in supply chains, or significant modifications to existing services may require a reassessment of security risks.
   • Regulatory Environment: New regulations, industry standards, or guidelines from supervisory authorities may introduce additional cybersecurity requirements, leading to the need to update risk assessments.
   • Threat Intelligence: Information regarding emerging threats, vulnerabilities specific to the sector or technologies used, or an increase in activities targeting similar organizations should trigger a risk reassessment.
3. Emphasis on Proportionality: NIS2 emphasizes that cybersecurity measures, including risk assessments, must be “proportionate” to the size of the entity, its risk profile, and the potential impact of incidents. Larger entities operating in high-risk sectors with critical services will likely need to conduct more frequent and in-depth risk assessments compared to smaller entities with lower risk profiles.
4. Periodic Audits and Reviews: NIS2 grants competent authorities the power to conduct regular and targeted audits on essential and important entities. Such audits may include reviews of cybersecurity risk management practices and could identify areas where risk assessments need to be updated or conducted more frequently.

Best Practices and Recommendations

In the absence of a specific frequency established by NIS2, it is advisable to adopt cybersecurity best practices and recommendations from trusted organizations. While not legally binding under NIS2, these resources often provide guidance on the frequency of risk assessments based on industry experience and the evolving threat landscape.

Note: The recommendations provided here are not derived directly from the sources you provided, but are based on common cybersecurity best practices. I suggest verifying this information independently.

• National Institute of Standards and Technology (NIST): The NIST framework, while not specific to NIS2, is a widely recognized resource. Although it does not prescribe a fixed frequency, it emphasizes that risk assessments should be conducted “periodically” and whenever significant changes occur.
• ENISA (European Union Agency for Cybersecurity): ENISA may publish guidelines or recommendations on the frequency of risk assessments in the context of NIS2 implementation. Consulting their resources could provide further insights.

Practical Steps

Although NIS2 does not set a specific frequency for cybersecurity risk assessments, the emphasis on a risk-based approach, the dynamic nature of cyber threats, and the need for proportionate measures clearly suggest that these assessments should be conducted regularly and not as an occasional exercise. Factors such as changes in business operations, the evolving threat landscape, and regulatory requirements must all be considered to determine the appropriate frequency. To understand how to structure this process within your organization, it may be useful to consult the page on the main objective of the NIS2 Directive or the official text of the NIS2 Directive, and evaluate a NIS2 compliance path that takes into account the organization’s specific risk profile.