NIS2 - Network and Information Security Directive (Directive (EU) 2022/2555)
ANNEX to the Commission Implementing Regulation laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler aws --compliance nis2_awsRequirements (120)
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)922
1.1.1.aset out the relevant entities approach to managing the security of their network and information systems;3
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
1.1 Policy on the security of network and information systems
1.1.1.cset out network and information security objectives;1
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
route53
- Sub Section
1.1 Policy on the security of network and information systems
1.1.1.dinclude a commitment to continual improvement of the security of network and information systems;4
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
1.1 Policy on the security of network and information systems
1.1.1.hlist the documentation to be kept and the duration of retention of the documentation;3
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
1.1 Policy on the security of network and information systems
1.1.2The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.3
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
1.1 Policy on the security of network and information systems
1.2.1As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities needs, and communicate them to the management bodies.3
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
1.2 Roles, responsibilities and authorities
1.2.3At least one person shall report directly to the management bodies on matters of network and information system security.1
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
account
- Sub Section
1.2 Roles, responsibilities and authorities
1.2.4Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.1
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
1.2 Roles, responsibilities and authorities
2.1.1For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities shall establish and maintain an appropriate risk management framework to identify and address the risks posed to the security of network and information systems. The relevant entities shall perform and document risk assessments and, based on the results, establish, implement and monitor a risk treatment plan. Risk assessment results and residual risks shall be accepted by management bodies or, where applicable, by persons who are accountable and have the authority to manage risks, provided that the relevant entities ensure adequate reporting to the management bodies.3
Attributes
- Section
1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
1.2 Roles, responsibilities and authorities
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)1342
2.1.2.afollow a risk management methodology;3
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.1.2.din line with an all-hazards approach, identify and document the risks posed to the security of network and information systems, in particular in relation to third parties and risks that could lead to disruptions in the availability, integrity, authenticity and confidentiality of the network and information systems, including the identification of single point of failures;3
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.1.2.eanalyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and risk level, taking into account cyber threat intelligence and vulnerabilities;1
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
2.1 Risk management framework
2.1.2.fevaluate the identified risks based on the risk criteria;3
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.1.2.gidentify and prioritise appropriate risk treatment options and measures;3
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.1.2.hcontinuously monitor the implementation of the risk treatment measures;3
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.1.2.iidentify who is responsible for implementing the risk treatment measures and when they should be implemented;1
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
ssm
- Sub Section
2.1 Risk management framework
2.1.2.jdocument the chosen risk treatment measures in a risk treatment plan and the reasons justifying the acceptance of residual risks in a comprehensible manner.2
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
2.1 Risk management framework
2.1.3When identifying and prioritising appropriate risk treatment options and measures, the relevant entities shall take into account the risk assessment results, the results of the procedure to assess the effectiveness of cybersecurity risk-management measures, the cost of implementation in relation to the expected benefit, the asset classification referred to in point 12.1., and the business impact analysis referred to in point 4.1.3.1
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
2.1 Risk management framework
2.1.4The relevant entities shall review and, where appropriate, update the risk assessment results and the risk treatment plan at planned intervals and at least annually, and when significant changes to operations or risks or significant incidents occur.2
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.1 Risk management framework
2.2.1The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.4
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.2 Compliance monitoring
2.2.3The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.12
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.2 Compliance monitoring
2.3.1The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.4
Attributes
- Section
2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
2.3 Independent review of information and network security
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)26170
3.1.1For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
ssm
- Sub Section
3.1 Incident handling policy
3.1.2.aa categorisation system for incidents that is consistent with the event assessment and classification carried out pursuant to point 3.4.1.;2
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.1 Incident handling policy
3.1.2.cassignment of roles to detect and appropriately respond to incidents to competent employees;3
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.1 Incident handling policy
3.1.2.ddocuments to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.4
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.1 Incident handling policy
3.1.3The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.3
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.1 Incident handling policy
3.2.1The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.2 Monitoring and logging
3.2.2To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.4
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.2 Monitoring and logging
3.2.3.arelevant outbound and inbound network traffic;5
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.bcreation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions;4
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.2 Monitoring and logging
3.2.3.caccess to systems and applications;61
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.dauthentication-related events;3
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.eall privileged access to systems and applications, and activities performed by administrative accounts;2
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.faccess or changes to critical configuration and backup files;10
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.gevent logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;14
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.3.huse of system resources, as well as their performance;4
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.2 Monitoring and logging
3.2.4The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically. The relevant entities shall ensure that, in case of an alarm, a qualified and appropriate response is initiated in a timely manner.5
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.2 Monitoring and logging
3.2.5The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.2 Monitoring and logging
3.4.1The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.3
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudtrail
- Sub Section
3.4 Event assessment and classification
3.4.2.creview the appropriate logs for the purposes of event assessment and classification;4
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.4 Event assessment and classification
3.4.2.dput in place a process for log correlation and analysis, and reassess and reclassify events in case of new information becoming available or after analysis of previously available information.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.4 Event assessment and classification
3.5.1The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
ssm
- Sub Section
3.5 Incident response
3.5.3.awith the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification;5
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.5 Incident response
3.5.4The relevant entities shall log incident response activities in accordance with the procedures referred to in point 3.2.1., and record evidence.11
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
3.5 Incident response
3.6.1Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from incidents. The post-incident reviews shall identify, where possible, the root cause of the incident and result in documented lessons learned to reduce the occurrence and consequences of future incidents.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
ssm
- Sub Section
3.6 Post-incident reviews
3.6.2The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.16
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.6 Post-incident reviews
3.6.3The relevant entities shall review at planned intervals if incidents led to post-incident reviews.1
Attributes
- Section
3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
3.6 Post-incident reviews
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)1144
4.1.1For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.6
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.1 Business continuity and disaster recovery plan
4.1.2.frecovery plans for specific operations, including recovery objectives;3
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
4.1 Business continuity and disaster recovery plan
4.1.2.grequired resources, including backups and redundancies;15
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.1 Business continuity and disaster recovery plan
4.1.3The relevant entities shall carry out a business impact analysis to assess the potential impact of severe disruptions to their business operations and shall, based on the results of the business impact analysis, establish continuity requirements for the network and information systems.1
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
4.1 Business continuity and disaster recovery plan
4.1.4The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.5
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.1 Business continuity and disaster recovery plan
4.2.2.bassurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;4
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
4.2 Backup and redundancy management
4.2.2.erestoring data from backup copies;3
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.2 Backup and redundancy management
4.2.2.fretention periods based on business and regulatory requirements.2
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.2 Backup and redundancy management
4.3.1The relevant entities shall put in place a process for crisis management.1
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
ssm
- Sub Section
4.3 Crisis management
4.3.2.aroles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;1
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
4.3 Crisis management
4.3.2.capplication of appropriate measures to ensure the maintenance of network and information system security in crisis situations.3
Attributes
- Section
4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
4.3 Crisis management
5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)413
5.1.2.athe cybersecurity practices of the suppliers and service providers, including their secure development procedures;5
Attributes
- Section
5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
5.1 Supply chain security policy
5.1.4.fan obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;2
Attributes
- Section
5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
5.1 Supply chain security policy
5.1.7.breview incidents related to ICT products and ICT services from suppliers and service providers;4
Attributes
- Section
5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
5.1 Supply chain security policy
5.1.7.danalyse the risks presented by changes related to ICT products and ICT services from suppliers and service providers and, where appropriate, take mitigating measures in a timely manner.2
Attributes
- Section
5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
5.1 Supply chain security policy
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)1587
6.1.2.brequirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;2
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.1 Security in acquisition of ICT services or ICT products
6.2.1Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.10
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.2 Secure development life cycle
6.2.2.acarry out an analysis of security requirements at the specification and design phases of any development or acquisition project undertaken by the relevant entities or on behalf of those entities;1
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.2 Secure development life cycle
6.2.2.bapply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;7
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.2 Secure development life cycle
6.2.2.clay down security requirements regarding development environments;5
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.2 Secure development life cycle
6.2.4The relevant entities shall review and, where necessary, update their secure development rules at planned intervals.2
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.2 Secure development life cycle
6.4.1The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management.4
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
6.4 Change management, repairs and maintenance
6.6.1.asecurity patches are applied within a reasonable time after they become available;5
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.6 Security patch management
6.7.2.bdetermine and apply controls to protect the relevant entities internal network domains from unauthorised access;7
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
networkfirewall
- Sub Section
6.7 Network security
6.7.2.enot use systems used for administration of the security policy implementation for other purposes;2
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
6.7 Network security
6.7.2.gwhere appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities;19
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
ec2
- Sub Section
6.7 Network security
6.7.2.iestablish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure;12
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.7 Network security
6.7.2.lapply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.4
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.7 Network security
6.8.2.aconsider the functional, logical and physical relationship, including location, between trustworthy systems and services;4
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
6.8 Network segmentation
6.9.2For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response software, which is updated regularly in accordance with the risk assessment carried out pursuant to point 2.1 and the contractual agreements with the providers.3
Attributes
- Section
6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudtrail
- Sub Section
6.9 Protection against malicious and unauthorised software
7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)411
7.2.bthe methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;8
Attributes
- Section
7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:
7.2.dwho is responsible for monitoring and measuring the effectiveness of the cybersecurity risk-management measures;1
Attributes
- Section
7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:
7.2.ewhen the results from monitoring and measurement are to be analysed and evaluated;1
Attributes
- Section
7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:
7.2.fwho has to analyse and evaluate these results.1
Attributes
- Section
7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)1040
9.2.ain accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit;13
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
9.2 Cryptography
9.2.cthe relevant entities approach to key management, including, where appropriate, methods for the following:6
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
9.2 Cryptography
9.2.c.igenerating different keys for cryptographic systems and applications;1
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
acm
- Sub Section
9.2 Cryptography
9.2.c.iiissuing and obtaining public key certificates;4
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
9.2 Cryptography
9.2.c.iiidistributing keys to intended entities, including how to activate keys when received;1
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
9.2 Cryptography
9.2.c.ivstoring keys, including how authorised users obtain access to keys;4
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
secretsmanager
- Sub Section
9.2 Cryptography
9.2.c.vchanging or updating keys, including rules on when and how to change keys;7
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
9.2 Cryptography
9.2.c.vibacking up or archiving keys;1
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
backup
- Sub Section
9.2 Cryptography
9.2.c.viilogging and auditing of key management-related activities;2
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
9.2 Cryptography
9.2.c.xiisetting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.1
Attributes
- Section
9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
9.2 Cryptography
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)2491
11.1.1For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network and information system security requirements.10
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.1 Access control policy
11.1.2.censure that access is only granted to users that have been adequately authenticated.4
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.1 Access control policy
11.2.1The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
accessanalyzer
- Sub Section
11.2 Management of access rights
11.2.2.aassign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;4
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.2 Management of access rights
11.2.2.densure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;6
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.2 Management of access rights
11.2.2.emaintain a register of access rights granted;1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
accessanalyzer
- Sub Section
11.2 Management of access rights
11.2.2.fapply logging to the management of access rights.4
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.2 Management of access rights
11.3.1The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.3 Privileged accounts and system administration accounts
11.3.2.aestablish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;3
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.3 Privileged accounts and system administration accounts
11.3.2.bset up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.3 Privileged accounts and system administration accounts
11.3.2.cindividualise and restrict system administration privileges to the highest extent possible,2
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.3 Privileged accounts and system administration accounts
11.3.2.dprovide that system administration accounts are only used to connect to system administration systems.1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.3 Privileged accounts and system administration accounts
11.4.2.aonly use system administration systems for system administration purposes, and not for any other operations;1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.4 Administration systems
11.4.2.bseparate logically such systems from application software not used for system administrative purposes,1
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.4 Administration systems
11.4.2.cprotect access to system administration systems through authentication and encryption.7
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.4 Administration systems
11.5.2.aset up unique identities for network and information systems and their users;6
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.5 Identification
11.5.2.dapply logging to the management of identities.3
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
cloudwatch
- Sub Section
11.5 Identification
11.5.4The relevant entities shall regularly review the identities for network and information systems and their users and, if no longer needed, deactivate them without delay.5
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
iam
- Sub Section
11.5 Identification
11.6.1The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.4
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.6 Authentication
11.6.2.aensure the strength of authentication is appropriate to the classification of the asset to be accessed;7
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.6 Authentication
11.6.2.crequire the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;4
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.6 Authentication
11.6.2.drequire the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts;2
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
cognito
- Sub Section
11.6 Authentication
11.6.2.eterminate inactive sessions after a predefined period of inactivity; and3
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
appstream
- Sub Section
11.6 Authentication
11.7.2The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.10
Attributes
- Section
11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
11.7 Multi-factor authentication
12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)420
12.1.2.calign the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.8
Attributes
- Section
12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
12.1 Asset classification
12.2.2.acover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;3
Attributes
- Section
12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
12.2 Handling of assets
12.2.2.bprovide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets;8
Attributes
- Section
12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
- Service
generic
- Sub Section
12.2 Handling of assets
12.2.2.cprovide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.1
Attributes
- Section
12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
- Service
transfer
- Sub Section
12.2 Handling of assets