Defence in depth

To mitigate risk to CIS, a range of technical and non-technical security measures, organised as multiple layers of defence, shall be implemented. These layers shall include: Deterrence: security measures aimed at dissuading any adversary planning to attack the CIS; Prevention: security measures aimed at impeding or blocking an attack on the CIS; Detection: security measures aimed at discovering the occurrence of an attack on the CIS; Resilience: security measures aimed at limiting impact of an attack to a minimum set of information or CIS assets and preventing further damage; and Recovery: security measures aimed at regaining a secure situation for the CIS. The degree of stringency of such security measures shall be determined following a risk assessment. The NSA or other competent authority shall ensure that: cyber defence capabilities are implemented to respond to threats which may transcend organisational and national boundaries; and responses are coordinated and information about these threats, incidents and the related risk is shared (computer emergency response capabilities).

← anx_IV__cpt_1__cpt_2__cpt_3__point_15__text_1 · All articles · 16. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.