rec_94

(94) Providers of public electronic communications networks or publicly available electronic communications services, or of both, should be required to take measures to safeguard the security of their networks and services, respectively, and to prevent or minimise the impact of security incidents. Having regard to the state of the art, those measures should ensure a level of security of networks and services appropriate to the risks posed. Security measures should take into account, as a minimum, all the relevant aspects of the following elements: as regards security of networks and facilities: physical and environmental security, security of supply, access control to networks and integrity of networks; as regards handling of security incidents: handling procedures, security incident detection capability, security incident reporting and communication; as regards business continuity management: service continuity strategy and contingency plans, disaster recovery capabilities; as regards monitoring, auditing and testing: monitoring and logging policies, exercise contingency plans, network and service testing, security assessments and compliance monitoring; and compliance with international standards.

← rec_93 · All articles · rec_95 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-28 · Text as adopted (Official Journal); later amendments are not incorporated in this text.