+ANNEX Technical and methodological requirements referred to in Article 2 of this Regulation
---+1. Policy on the security of network and information systems (Article 21(2), point (a) of Directive …
------+1.1. Policy on the security of network and information systems
---------+1.1.1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the …
---------+1.1.2. The network and information system security policy shall be reviewed and, where appropriate …
------+1.2. Roles, responsibilities and authorities
---------+1.2.1. As part of their policy on the security of network and information systems referred to in …
---------+1.2.2. The relevant entities shall require all personnel and third parties to apply network and …
---------+1.2.3. At least one person shall report directly to the management bodies on matters of network and …
---------+1.2.4. Depending on the size of the relevant entities, network and information system security …
---------+1.2.5. Conflicting duties and conflicting areas of responsibility shall be segregated, where …
---------+1.2.6. Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by …
---+2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)
------+2.1. Risk management framework
---------+2.1.1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant …
---------+2.1.2. For the purpose of point 2.1.1, the relevant entities shall establish procedures for …
---------+2.1.3. When identifying and prioritising appropriate risk treatment options and measures, the …
---------+2.1.4. The relevant entities shall review and, where appropriate, update the risk assessment …
------+2.2. Compliance monitoring
---------+2.2.1. The relevant entities shall regularly review the compliance with their policies on network …
---------+2.2.2. The relevant entities shall put in place an effective compliance reporting system which …
---------+2.2.3. The relevant entities shall perform the compliance monitoring at planned intervals and when …
------+2.3. Independent review of information and network security
---------+2.3.1. The relevant entities shall review independently their approach to managing network and …
---------+2.3.2. The relevant entities shall develop and maintain processes to conduct independent reviews …
---------+2.3.3. The results of the independent reviews, including the results from the compliance monitoring …
---------+2.3.4. The independent reviews shall take place at planned intervals and when significant incidents …
---+3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
------+3.1. Incident handling policy
---------+3.1.1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant …
---------+3.1.2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and …
---------+3.1.3. The roles, responsibilities and procedures laid down in the policy shall be tested and …
------+3.2. Monitoring and logging
---------+3.2.1. The relevant entities shall lay down procedures and use tools to monitor and log activities …
---------+3.2.2. To the extent feasible, monitoring shall be automated and carried out either continuously or …
---------+3.2.3. Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain …
---------+3.2.4. The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate …
---------+3.2.5. The relevant entities shall maintain and back up logs for a predefined period and shall …
---------+3.2.6. To the extent feasible, the relevant entities shall ensure that all systems have …
---------+3.2.7. The procedures as well as the list of assets that are being logged shall be reviewed and …
------+3.3. Event reporting
---------+3.3.1. The relevant entities shall put in place a simple mechanism allowing their employees …
---------+3.3.2. The relevant entities shall, where appropriate, communicate the event reporting mechanism to …
------+3.4. Event assessment and classification
---------+3.4.1. The relevant entities shall assess suspicious events to determine whether they constitute …
---------+3.4.2. For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) …
------+3.5. Incident response
---------+3.5.1. The relevant entities shall respond to incidents in accordance with documented procedures …
---------+3.5.2. The incident response procedures shall include the following stages: (a) incident …
---------+3.5.3. The relevant entities shall establish communication plans and procedures: (a) with the …
---------+3.5.4. The relevant entities shall log incident response activities in accordance with the …
---------+3.5.5. The relevant entities shall test at planned intervals their incident response procedures.
------+3.6. Post-incident reviews
---------+3.6.1. Where appropriate, the relevant entities shall carry out post-incident reviews after …
---------+3.6.2. The relevant entities shall ensure that post-incident reviews contribute to improving their …
---------+3.6.3. The relevant entities shall review at planned intervals if incidents led to post-incident …
---+4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)
------+4.1. Business continuity and disaster recovery plan
---------+4.1.1. For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant …
---------+4.1.2. The relevant entities’ operations shall be restored according to the business continuity and …
---------+4.1.3. The relevant entities shall carry out a business impact analysis to assess the potential …
---------+4.1.4. The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …
------+4.2. Backup and redundancy management
---------+4.2.1. The relevant entities shall maintain backup copies of data and provide sufficient available …
---------+4.2.2. Based on the results of the risk assessment carried out pursuant to point 2.1 and the …
---------+4.2.3. The relevant entities shall perform regular integrity checks on the backup copies.
---------+4.2.4. Based on the results of the risk assessment carried out pursuant to point 2.1 and the …
---------+4.2.5. Where appropriate, the relevant entities shall ensure that monitoring and adjustment of …
---------+4.2.6. The relevant entities shall carry out regular testing of the recovery of backup copies and …
------+4.3. Crisis management
---------+4.3.1. The relevant entities shall put in place a process for crisis management.
---------+4.3.2. The relevant entities shall ensure that the crisis management process addresses at least the …
---------+4.3.3. The relevant entities shall implement a process for managing and making use of information …
---------+4.3.4. The relevant entities shall test, review and, where appropriate, update the crisis …
---+5. Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)
------+5.1. Supply chain security policy
---------+5.1.1. For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant …
---------+5.1.2. As part of the supply chain security policy referred to in point 5.1.1, the relevant …
---------+5.1.3. When establishing their supply chain security policy, relevant entities shall take into …
---------+5.1.4. Based on the supply chain security policy and taking into account the results of the risk …
---------+5.1.5. The relevant entities shall take into account the elements referred to in point 5.1.2 and …
---------+5.1.6. The relevant entities shall review the supply chain security policy, and monitor, evaluate …
---------+5.1.7. For the purpose of point 5.1.6, the relevant entities shall: (a) regularly monitor reports …
------+5.2. Directory of suppliers and service providers
---+6. Security in network and information systems acquisition, development and maintenance (Article …
------+6.1. Security in acquisition of ICT services or ICT products
---------+6.1.1. For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant …
---------+6.1.2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include: (a) …
---------+6.1.3. The relevant entities shall review and, where appropriate, update the processes at planned …
------+6.2. Secure development life cycle
---------+6.2.1. Before developing a network and information system, including software, the relevant …
---------+6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
---------+6.2.3. For outsourced development of network and information systems, the relevant entities shall …
---------+6.2.4. The relevant entities shall review and, where necessary, update their secure development …
------+6.3. Configuration management
---------+6.3.1. The relevant entities shall take the appropriate measures to establish, document, implement …
---------+6.3.2. For the purpose of point 6.3.1, the relevant entities shall: (a) lay down and ensure …
---------+6.3.3. The relevant entities shall review and, where appropriate, update configurations at planned …
------+6.4. Change management, repairs and maintenance
---------+6.4.1. The relevant entities shall apply change management procedures to control changes of network …
---------+6.4.2. The procedures referred to in point 6.4.1 shall be applied for releases, modifications and …
---------+6.4.3. In the event that the regular change management procedures could not be followed due to an …
---------+6.4.4. The relevant entities shall review and, where appropriate, update the procedures at planned …
------+6.5. Security testing
---------+6.5.1. The relevant entities shall establish, implement and apply a policy and procedures for …
---------+6.5.2. The relevant entities shall: (a) establish, based on the risk assessment carried out …
---------+6.5.3. The relevant entities shall review and, where appropriate, update their security testing …
------+6.6. Security patch management
---------+6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
---------+6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
------+6.7. Network security
---------+6.7.1. The relevant entities shall take the appropriate measures to protect their network and …
---------+6.7.2. For the purpose of point 6.7.1, the relevant entities shall: (a) document the architecture …
---------+6.7.3. The relevant entities shall review and, where appropriate, update these measures at planned …
------+6.8. Network segmentation
---------+6.8.1. The relevant entities shall segment systems into networks or zones in accordance with the …
---------+6.8.2. For that purpose, the relevant entities shall: (a) consider the functional, logical and …
---------+6.8.3. The relevant entities shall review and, where appropriate, update network segmentation at …
------+6.9. Protection against malicious and unauthorised software
---------+6.9.1. The relevant entities shall protect their network and information systems against malicious …
---------+6.9.2. For that purpose, the relevant entities shall in particular implement measures that detect …
------+6.10. Vulnerability handling and disclosure
---------+6.10.1. The relevant entities shall obtain information about technical vulnerabilities in their …
---------+6.10.2. For the purpose of point 6.10.1, the relevant entities shall: (a) monitor information about …
---------+6.10.3. When justified by the potential impact of the vulnerability, the relevant entities shall …
---------+6.10.4. The relevant entities shall review and, where appropriate, update at planned intervals the …
---+7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures …
------+7.1. For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
------+7.2. The policy and procedures referred to in point 7.1 shall take into account results of the risk …
------+7.3. The relevant entities shall review and, where appropriate, update the policy and procedures at …
---+8. Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) …
------+8.1. Awareness raising and basic cyber hygiene practices
---------+8.1.1. For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant …
---------+8.1.2. For the purpose of point 8.1.1, the relevant entities shall offer to their employees …
---------+8.1.3. The awareness raising programme shall, where appropriate, be tested in terms of …
------+8.2. Security training
---------+8.2.1. The relevant entities shall identify employees, whose roles require security relevant skill …
---------+8.2.2. The relevant entities shall establish, implement and apply a training program in line with …
---------+8.2.3. The training referred to in point 8.2.1 shall be relevant to the job function of the …
---------+8.2.4. The relevant entities shall apply training to staff members who transfer to new positions or …
---------+8.2.5. The program shall be updated and run periodically taking into account applicable policies …
---+9. Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)
------+9.1. For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
------+9.2. The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the …
------+9.3. The relevant entities shall review and, where appropriate, update their policy and procedures …
---+10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)
------+10.1. Human resources security
---------+10.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+10.1.2. The requirement referred to in point 10.1.1 shall include the following: (a) mechanisms to …
---------+10.1.3. The relevant entities shall review the assignment of personnel to specific roles as …
------+10.2. Verification of background
---------+10.2.1. The relevant entities shall ensure to the extent feasible verification of the background of …
---------+10.2.2. For the purpose of point 10.2.1, the relevant entities shall: (a) put in place criteria …
---------+10.2.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+10.3. Termination or change of employment procedures
---------+10.3.1. The relevant entities shall ensure that network and information system security …
---------+10.3.2. For the purpose of point 10.3.1, the relevant entities shall include in the individual’s …
------+10.4. Disciplinary process
---------+10.4.1. The relevant entities shall establish, communicate and maintain a disciplinary process for …
---------+10.4.2. The relevant entities shall review and, where appropriate, update the disciplinary process …
---+11. Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)
------+11.1. Access control policy
---------+11.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+11.1.2. The policies referred to in point 11.1.1. shall: (a) address access by persons, including …
---------+11.1.3. The relevant entities shall review and, where appropriate, update the policies at planned …
------+11.2. Management of access rights
---------+11.2.1. The relevant entities shall provide, modify, remove and document access rights to network …
---------+11.2.2. The relevant entities shall: (a) assign and revoke access rights based on the principles of …
---------+11.2.3. The relevant entities shall review access rights at planned intervals and shall modify them …
------+11.3. Privileged accounts and system administration accounts
---------+11.3.1. The relevant entities shall maintain policies for management of privileged accounts and …
---------+11.3.2. The policies referred to in point 11.3.1 shall: (a) establish strong identification …
---------+11.3.3. The relevant entities shall review access rights of privileged accounts and system …
------+11.4. Administration systems
---------+11.4.1. The relevant entities shall restrict and control the use of system administration systems …
---------+11.4.2. For that purpose, the relevant entities shall: (a) only use system administration systems …
------+11.5. Identification
---------+11.5.1. The relevant entities shall manage the full life cycle of identities of network and …
---------+11.5.2. For that purpose, the relevant entities shall: (a) set up unique identities for network and …
---------+11.5.3. The relevant entities shall only permit identities assigned to multiple persons, such as …
---------+11.5.4. The relevant entities shall regularly review the identities for network and information …
------+11.6. Authentication
---------+11.6.1. The relevant entities shall implement secure authentication procedures and technologies …
---------+11.6.2. For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …
---------+11.6.3. The relevant entities shall to the extent feasible use state-of-the-art authentication …
---------+11.6.4. The relevant entities shall review the authentication procedures and technologies at …
------+11.7. Multi-factor authentication
---------+11.7.1. The relevant entities shall ensure that users are authenticated by multiple authentication …
---------+11.7.2. The relevant entities shall ensure that the strength of authentication is appropriate for …
---+12. Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)
------+12.1. Asset classification
---------+12.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+12.1.2. For the purpose of point 12.1.1, the relevant entities shall: (a) lay down a system of …
---------+12.1.3. The relevant entities shall conduct periodic reviews of the classification levels of assets …
------+12.2. Handling of assets
---------+12.2.1. The relevant entities shall establish, implement and apply a policy for the proper handling …
---------+12.2.2. The policy shall: (a) cover the entire life cycle of the assets, including acquisition …
---------+12.2.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+12.3. Removable media policy
---------+12.3.1. The relevant entities shall establish, implement and apply a policy on the management of …
---------+12.3.2. The policy shall: (a) provide for a technical prohibition of the connection of removable …
---------+12.3.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+12.4. Asset inventory
---------+12.4.1. The relevant entities shall develop and maintain a complete, accurate, up-to-date and …
---------+12.4.2. The granularity of the inventory of the assets shall be at a level appropriate for the …
---------+12.4.3. The relevant entities shall regularly review and update the inventory and their assets and …
------+12.5. Deposit, return or deletion of assets upon termination of employment
---+13. Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) …
------+13.1. Supporting utilities
---------+13.1.1. For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities …
---------+13.1.2. For that purpose, the relevant entities shall, where appropriate: (a) protect facilities …
---------+13.1.3. The relevant entities shall test, review and, where appropriate, update the protection …
------+13.2. Protection against physical and environmental threats
---------+13.2.1. For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities …
---------+13.2.2. For that purpose, the relevant entities shall, where appropriate: (a) design and implement …
---------+13.2.3. The relevant entities shall test, review and, where appropriate, update the protection …
------+13.3. Perimeter and physical access control
---------+13.3.1. For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities …
---------+13.3.2. For that purpose, the relevant entities shall: (a) on the basis of the risk assessment …
---------+13.3.3. The relevant entities shall test, review and, where appropriate, update the physical access …

ANNEX Technical and methodological requirements referred to in Article 2 of this Regulation

ANNEX

Technical and methodological requirements referred to in Article 2 of this Regulation

1. Overview

,
1. Policy on the security of network and information systems (Article 21(2), point (a) of Directive …

1.   Policy on the security of network and information systems (Article 21(2), point (a) of Directive (EU) 2022/2555)

2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)

2.   Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)

3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)

3.   Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)

4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)

4.   Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)

5. Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)

5.   Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)

6. Security in network and information systems acquisition, development and maintenance (Article …

6.   Security in network and information systems acquisition, development and maintenance (Article 21(2), point (e), of Directive (EU) 2022/2555)

7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures …

7.   Policies and procedures to assess the effectiveness of cybersecurity risk-management measures (Article 21(2), point (f), of Directive (EU) 2022/2555)

8. Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) …

8.   Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) 2022/2555)

9. Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)

9.   Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)

10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)

10.   Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)

11. Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)

11.   Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)

12. Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)

12.   Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)

13. Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) …

13.   Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) 2022/2555)

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards
  • Builddate: 18.10.2024 00:00:00 -Doknr: CELEX:32024R2690
  • EULAW -

    EN: Legal acts of the European Union from EUR-Lex, https://eur-lex.europa.eu/. © European Union. Re-use is authorised by Decision 2011/833/EU, provided the source is acknowledged; the consolidated texts are licensed under CC BY 4.0 (EUR-Lex legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the legislation published in the Official Journal of the European Union is deemed authentic.

    DE: Rechtsakte der Europäischen Union aus EUR-Lex, https://eur-lex.europa.eu/. © Europäische Union. Weiterverwendung nach Beschluss 2011/833/EU mit Quellenangabe gestattet; die konsolidierten Fassungen stehen unter CC BY 4.0 (Rechtlicher Hinweis von EUR-Lex). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Verbindlich sind allein die im Amtsblatt der Europäischen Union veröffentlichten Rechtsakte.