1. POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS
2. RISK MANAGEMENT POLICY
3. INCIDENT HANDLING
4. BUSINESS CONTINUITY AND CRISIS MANAGEMENT
5. SUPPLY CHAIN SECURITY
6. SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE
7. POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES
8. BASIC CYBER HYGIENE PRACTICES AND SECURITY TRAINING
9. CRYPTOGRAPHY
10. HUMAN RESOURCES SECURITY
11. ACCESS CONTROL
12. ASSET MANAGEMENT
13. ENVIRONMENTAL AND PHYSICAL SECURITY

ANNEX zur NIS2-Umsetzungsverordnung der EU

Inhalte der NIS2-Ums.VO

Hier werden die Anhänge der NIS2-Umsetzungsverordnung dargestellt.

1. POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS

1.1 Policy on the security of network and information systems
1.2 Roles, responsibilities and authorities

2. RISK MANAGEMENT POLICY

2.1 Risk management framework
2.2. Compliance monitoring
2.3 Independent review of information and network security

3. INCIDENT HANDLING

3.1 Incident handling policy
3.2 Monitoring and logging
3.3 Event reporting
3.4 Event assessment and classification
3.5 Incident response
3.6 Post-incident reviews

4. BUSINESS CONTINUITY AND CRISIS MANAGEMENT

4.1 Business continuity and disaster recovery plans
4.2 Backup management
4.3 Crisis management

5. SUPPLY CHAIN SECURITY

5.1 Supply chain security policy
5.2 Directory of suppliers and service providers

6. SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE

6.1 Security in acquisition of ICT services or ICT products
6.2 Secure development life cycle
6.3 Configuration management
6.4 Change management, repairs and maintenance
6.5 Security testing
6.6 Security patch management
6.7 Network security
6.8 Network segmentation
6.9 Protection against malicious and unauthorised software
6.10 Vulnerability handling and disclosure

7. POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES

7. POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES

8. BASIC CYBER HYGIENE PRACTICES AND SECURITY TRAINING

8.1 Awareness raising and basic cyber hygiene practices
8.2 Security training

9. CRYPTOGRAPHY

9. CRYPTOGRAPHY

10. HUMAN RESOURCES SECURITY

10.1 Human resources security
10.2 Background checks
10.3 Termination or change of employment procedures
10.4 Disciplinary process

11. ACCESS CONTROL

11.1 Access control policy
11.2 Management of access rights
11.3 Privileged accounts and system administration accounts
11.4 Administration systems
11.5 Identification
11.6 Authentication
11.7 Multi-factor authentication

12. ASSET MANAGEMENT

12.1 Asset classification
12.2 Handling of information and assets
12.3 Removable media policy
12.4 Asset inventory
12.5 Return or deletion of assets upon termination of employment

13. ENVIRONMENTAL AND PHYSICAL SECURITY

13.1 Supporting utilities
13.2 Protection against physical and environmental threats
13.3 Perimeter and physical access control