Article 21 2.

policies on risk analysis and information system security;

incident handling;

business continuity, such as backup management and disaster recovery, and crisis management;

supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;

security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;

policies and procedures to assess the effectiveness of cybersecurity risk-management measures;

basic cyber hygiene practices and cybersecurity training;

policies and procedures regarding the use of cryptography and, where appropriate, encryption;

human resources security, access control policies and asset management;

the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.