Introduction

Background

On 18 October 2024, the European Commission published Commission Implementing Regulation 2024/2690 of 17 October 2024, hereafter the regulation , pursuant to Articles 21(5), first subparagraph and 23(11), second subparagraph, of Directive (EU) 2022/2555 (hereafter the NIS2 Directive). Article 2 of this regulation specifies that, for the essential and important entities in scope of the regulation (hereafter ‘relevant entities’), the technical and methodological requirements of cybersecurity risk-management measures referred to in Article 21(2), points (a) to (j), of the NIS2 Directive are set out in the Annex to the regulation .

According to recital 7, the European Union Agency for Cybersecurity (ENISA) can support relevant entities by providing guidance on the implementation of the technical and methodological requirements referred to in the Annex to the regulation. This implementation guidance was developed by ENISA is collaboration with the Network and Information Systems Cooperation Group (NIS CG) and the European Commission. ENISA published an early draft of this guidance as part of a public consultation, to solicit feedback and input from the private sector. ENISA also consulted with various relevant workstreams of the NIS Cooperation group, as well as the ENISA expert group for European Competent Authorities for Trust Services (ECATS) and the ENISA expert group for European Competent Authorities for Secure Electronic Communications (ECASEC).

Goal

The document provides non-binding guidance for relevant entities to the regulation on the technical and methodological requirements of the cybersecurity risk management measures.

Target audience

Beyond the relevant entities to the regulation, this guidance may provide indications on the technical and methodological requirements of the cybersecurity risk management measures of the NIS2 Directive, which may be considered useful by other public or private bodies for improving their cybersecurity.

Structure

The Annex to the regulation consists of 13 titles with a varying number of technical and methodological requirements (see Figure 1). Each technical and methodological requirement is highlighted (blue font and grey background) and is included in this document for readability.

Each requirement is followed by three elements: guidance, examples of evidence and tips (2). This part of the document is not legally binding and is only recommendations (3).

1. The guidance section contains indicative and actionable advice on parameters to consider when implementing a technical and methodological requirement or further explanation of concepts found in the legal text. 2. Examples of evidence are indicative types of evidence showing that a technical and methodological requirement is in place.

3. In some technical and methodological requirements, extra general tips are also offered for additional consideration by the entity.

Figure 1: Technical and methodological requirements of the cybersecurity risk-management measures

(Annex to Commission Implementing Regulation 2024/2690)

Figure 2: Technical and methodological measures structure

The guidance, examples of evidence and tips are non-exhaustive. Their partial or complete implementation does

not assume compliance or conformity with the requirements of the regulation. Relevant entities may choose alternative methods to fulfil a requirement or use different evidence to demonstrate compliance. Moreover, a single piece of evidence may support various requirements; for example, an organisational chart can demonstrate both ‘roles and responsibilities’ and ‘segregation of duties’. Consequently, evidence may appear multiple times within the text.

Finally, each requirement is mapped to (a) requirements of European and international standards or frameworks (International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27001:2022, ISO/IEC 27002:2022 (4), NIST Cybersecurity Framework 2.0, ETSI EN 319 401 V3.1.1 (2024–06), European Committee for Standardization Technical Specification (CEN/TS) 18026:2024) and (b) to the NIS2 national frameworks (5) . The mapping to standards and frameworks is available on the ENISA website in Excel format (6). It should be noted that the mapping was done only to horizontal standards and for specific topics. Detailed standards or technical specifications are referenced in footnotes, where available. These standards are included as examples, as they are commonly used. The choice of which standards and good practices to apply should be made by the entity, as they may relate to the context of the entity’s activities and characteristics.

To implement the requirements, the relevant entities may build upon their current usage of standards or frameworks, if available. Annex I of this document provides details for each national framework submitted to ENISA during the consultation phases, while some terms are explained in Annex II. The document does not aim to establish a new standard or to duplicate existing ones (e.g. ISO, IEC and CEN). The guidance is written in a technology-neutral and standards-neutral way.

The mapping should not be interpreted as a measure of equivalency among different standards or frameworks. It simply refers to relevant requirements in these standards or frameworks without assessing whether these fully cover the requirements of the regulation. Cybersecurity standards or frameworks often address the same cybersecurity concerns but use different language, structures or levels of specificity or detail. Understanding these relationships may help relevant entities use and integrate multiple standards or frameworks efficiently, to maintain compliance, reduce duplication and streamline audits.

Relevant entities subject to the regulation can use national frameworks, guidance, standards or other mechanisms equivalent to the requirements of the regulation to demonstrate their compliance to national competent authorities. Depending on the national framework, compliance with the requirements set out by the regulation could be demonstrated by means of assessment or certification by relevant accredited conformity assessment bodies or by independent auditors authorised by the national competent authorities or certification bodies authorised by the national competent authorities, against the national frameworks, guidelines, standards or other mechanisms equivalent to technical and methodological requirements for cybersecurity risk-management measures. To keep the current guidance up to date, Member States can inform ENISA of those equivalent national frameworks, guidance, standards or other mechanisms, if available.

Topic-specific policies As described in preamble 9 of the regulation, the policy on the security of network and information systems (7)

(Annex to the regulation, point 1.1) should be the highest-level document setting out the relevant entities’ overall approach to the security of their network and information systems and should be approved by the management bodies of the entities.

In addition to this overarching corporate policy, the following topic-specific, documented policies (8) are required.

1. Risk management policy (Annex to the regulation, point 2). 2. Incident handling policy (Annex to the regulation, point 3.1.1). 3. Supply chain security policy (Annex to the regulation, point 5.1.1). 4. Security testing policy (Annex to the regulation, point 6.5.1).

5. Policy to assess the effectiveness of cybersecurity risk management measures (Annex to the regulation,

point 7.1.1). 6. Policy related to cryptography (Annex to the regulation, point 9.1). 7. Access control policy (Annex to the regulation, point 11.1.1).

8. Policies for the management of privileged accounts and system administration accounts (Annex to the

regulation, point 11.3) 9. Handling of information and assets policy (Annex to the regulation, point 12.2.1). 10. Removable media policy (Annex to the regulation, point 12.3.1).

Documenting the aforementioned topic-specific policies is mandatory. However, the relevant entity should use its discretion to determine the format of documentation, whether it be through separate documents, updates to existing policies or a single comprehensive document.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

• ENISA -