Policies for risk analysis and information system security. The organisation must have documented processes to identify and manage risks to network and information systems.

Incident handling: The organisation must have processes to detect, report and respond to security incidents within NIS2 deadlines (24h to CSIRT, 72h to authority).

Business continuity, including backup, disaster recovery and crisis management. The organisation must be able to maintain critical functions during and after an incident.

Security in the supply chain, including security-related aspects of the relationships with direct suppliers and service providers.

Security in the acquisition, development and maintenance of network and information systems, including the handling and disclosure of vulnerabilities.

Policies and procedures for the use of cryptography and, where appropriate, encryption.

Human resource security, access control policies and asset management. Roles, permissions and awareness of security requirements.

Use of multi-factor authentication or continuous authentication, secure voice, video and text communications, and secured emergency communication systems.

Policies and procedures for assessing the effectiveness of cybersecurity risk management measures, including vulnerability scanning.