Annex II glossary

Asset: anything that is of value to the entity, including information. Overall, the assets of a network and information system are personnel, processes, information, software and hardware.

Crisis: an abnormal or extraordinary event or situation that threatens an organisation or community and requires a strategic, adaptive and timely response to preserve its viability and integrity (110).

Critical: one of the classification levels assigned to the entity’s assets following an assessment of their criticality, including the asset classification (Annex to the regulation, point 12.1).

Cyber hygiene practices (111) :

• Cyber hygiene practices for essential and important entities are a common baseline set of network and information security practices, which are already covered by the technical and methodological requirements of the cybersecurity risk-management measures outlined in the Annex to the regulation. Therefore, no additional guidance on cyber hygiene practices for essential and important entities is deemed necessary.
• Cyber hygiene practices relating to users are a set of routine, proactive practices and behaviours that the entity’s users follow to maintain the network and information security of the entity’s systems. These practices are explicitly mentioned in the guidance of section 8.1.

Direct suppliers and service providers: any entity providing ICT products, ICT systems or ICT services that an essential or important entity relies on. When this guidance refers to direct suppliers and service providers, it includes their personnel.

Entity: one of the relevant entities in the scope of Commission Implementing Regulation (EU) 2024/2690. In other standards or good practice guides, the term ‘organisation’, ‘enterprise’ or ‘business’ may be used. Event: in reference to an information security event, an identified occurrence indicating a possible information security breach or failure of controls (112). Facilities: the physical location housing the entity’s network and information systems.

Incident handling: any actions and procedures aiming to prevent, detect, analyse and contain, or to respond to and recover from, an incident (NIS2 Directive Article 6(8)).

Incident: an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible through, network and information systems (NIS2 Directive Article 6(6)).

Information: data in context. In the text, we primarily use ‘information’, unless we refer specifically to data (‘data breach’ etc.).

Management bodies: the highest-level leadership within essential and important entities as in the context of Article 20 of the NIS2 Directive.

Measure: a cybersecurity risk-management measure as referred to in the NIS2 Directive. The word is used similarly to ‘control’, which denotes a measure that modifies risk (113). In addition, the terms ‘measure’ and ‘protection measure’ are used interchangeably.

Personnel: persons doing work under the entity’s direction (114). The concept of personnel includes the entity’s members, such as the governing body, management bodies, employees, temporary staff, contractors and volunteers. In this document it is used interchangeably with the term ‘employees’.

Policy: intentions and direction of an organisation, as formally expressed by its management bodies. Privileged access: the necessary permissions granted to specific users of the network and the information system of the entity, in order for them to perform tasks that regular users cannot. Procedure: a specified way to carry out an activity or a process (115). The entity can document its needs for more detailed information in a way that is efficient for it beyond the policy. These are mainly procedures and processes.

Process: an activity that transforms input into output. Rule: accepted principle or instruction that states the entity’s expectations of what is required to be done and what is allowed or not allowed. Rules can be formally expressed in topic-specific policies and in other types of documents (116).

Significant incident: an incident that meets the criteria of Article 3 of the regulation.

Suspicious event: an event that appears unusual or a previously unknown situation that might be a potential security threat. To make clearer the difference between an event and a suspicious event, consider an example where a legitimate user fails to log in once due to a typing error. This is an event. However, a situation where a user fails to log in after five attempts might be considered a suspicious event.

Topic-specific policy: a policy on a specific subject or topic, as formally expressed by the management bodies relevant to the topic.

User: all legal and natural persons that have access to the entity’s network and information systems (recital 10 of the regulation).

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

• ENISA -