1.

Member States shall ensure that digital service providers identify and take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems which they use in the context of offering services referred to in Annex III within the Union. Having regard to the state of the art, those measures shall ensure a level of security of network and information systems appropriate to the risk posed, and shall take into account the following elements: the security of systems and facilities; incident handling; business continuity management; monitoring, auditing and testing; compliance with international standards.

← Article 16 · All articles · art_16__para_1__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-28 · Text as adopted (Official Journal); later amendments are not incorporated in this text.