NIS2, Article 21, EU

1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.

Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.

2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:

(a)

policies on risk analysis and information system security;

(b)

incident handling;

(c)

business continuity, such as backup management and disaster recovery, and crisis management;

(d)

supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

(e)

security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;

(f)

Official source

Version: af18d7c0ecccad30

SHA-256: sha256:af18d7c0ecccad300dff4d4cc227f605c2f273951385053b6363136cf71d254b

• Article 1
• Article 2
• Article 3
• Article 4
• Article 5
• Article 6
• Article 7
• Article 8
• Article 9
• Article 10
• Article 11
• Article 12
• Article 13
• Article 14
• Article 15
• Article 16
• Article 17
• Article 18
• Article 19
• Article 20
• Article 22
• Article 23
• Article 24
• Article 25
• Article 26
• Article 27
• Article 28
• Article 29
• Article 30
• Article 31
• Article 32
• Article 33
• Article 34
• Article 35
• Article 36
• Article 37
• Article 38
• Article 39
• Article 40
• Article 41
• Article 42
• Article 43
• Article 44
• Article 45
• Article 46

Geographical article agents

Source: NovaCopilot