The NIS2 Directive requires entities to implement robust and structured cybersecurity risk management policies. At the heart of these policies are ten key security elements that form the backbone of an organization’s cybersecurity posture. For organizations that need to verify their level of compliance, a structured NIS2 compliance path helps translate these requirements into concrete and verifiable measures.

These elements, outlined in the sources, are:

1. Incident Management: This covers the entire lifecycle of cybersecurity incident management, from preparation and prevention to detection, analysis, containment, eradication, recovery, and post-incident learning.
2. Supply Chain Security: Entities must proactively address cybersecurity risks within their supply chains. This includes assessing the security posture of suppliers, establishing clear security requirements for third-party relationships, and implementing mechanisms to monitor and manage risks associated with suppliers and service providers.
3. Vulnerability Management and Disclosure: A systematic approach to identifying, assessing, prioritizing, resolving, and disclosing vulnerabilities is essential. This includes establishing processes to receive vulnerability reports, assessing their severity, implementing patches or mitigation measures in a timely manner, and responsibly disclosing vulnerabilities to stakeholders.
4. Use of Cryptography and Encryption Techniques: The use of cryptographic techniques and encryption technologies is fundamental to protecting the confidentiality, integrity, and authenticity of data. Entities should implement appropriate encryption solutions for data at rest, in transit, and, where necessary, in use.
5. Policies for Risk Analysis and Information System Security: Entities must establish and document clear policies for analyzing cybersecurity risks and defining security measures for their information systems. This involves periodic risk assessments, the identification of assets and their criticality, and the development of comprehensive risk management plans.
6. Business Continuity Management, Including Backup, Disaster Recovery, and Crisis Management: Organizations must have plans in place to ensure business continuity in the event of disruptions or disasters. This includes implementing robust backup and disaster recovery mechanisms, developing crisis management plans, and periodically testing these procedures to ensure their effectiveness.
7. Security in Network and Information System Acquisition, Development, and Maintenance: Security considerations must be integrated throughout the entire lifecycle of networks and information systems. This includes secure development practices, security testing, secure configuration, vulnerability management, and secure disposal of systems at the end of their lifecycle.
8. Strategies and Procedures for Assessing the Effectiveness of Cybersecurity Risk Management: Periodic assessments and reviews of the implemented cybersecurity risk management measures are critical. This involves establishing metrics, conducting periodic reviews, and implementing improvements based on findings to ensure the ongoing effectiveness of the cybersecurity posture.
9. Basic Cyber Hygiene Practices and Training: Promoting a culture of cybersecurity awareness and best practices among employees is essential. This includes offering periodic cybersecurity training programs, raising awareness of common threats, and adopting responsible behaviors in the daily management of IT activities.
10. Human Resources Security, Access Control Strategies, and Asset Management: Entities must address security risks associated with human resources, access control, and asset management. This includes implementing robust access control mechanisms, enforcing the principle of least privilege, conducting background checks on employees, and implementing secure asset management practices.

By addressing these ten key elements within their cybersecurity risk management policies, entities can establish a solid foundation for a resilient security posture, ensuring the protection of their systems, data, and services against ever-evolving cyber threats. To delve deeper into the regulatory framework, the official text of the NIS2 Directive is available.