art_21__para_2

2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: policies on risk analysis and information system security; incident handling; business continuity, such as backup management and disaster recovery, and crisis management; supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure; policies and procedures to assess the effectiveness of cybersecurity risk-management measures; basic cyber hygiene practices and cybersecurity training; policies and procedures regarding the use of cryptography and, where appropriate, encryption; human resources security, access control policies and asset management; the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

← art_21__para_1__para · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.