NIS2 - Network and Information Security Directive (Directive (EU) 2022/2555)

nis2_azure

NIS2

OfficialVerified

ANNEX to the Commission Implementing Regulation laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers

91requirements133checks

Prowler prowler-provider-azure

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler azure --compliance nis2_azure

Requirements (91)

1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)49

1.1.1.aset out the relevant entities approach to managing the security of their network and information systems;1

Attributes

Section: 1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 1.1 Policy on the security of network and information systems

1.1.1.cset out network and information security objectives;3

Attributes

Section: 1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 1.1 Policy on the security of network and information systems

1.2.1As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities needs, and communicate them to the management bodies.3

Attributes

Section: 1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 1.2 Roles, responsibilities and authorities

1.2.4Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.2

Attributes

Section: 1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: sqlserver
Sub Section: 1.2 Roles, responsibilities and authorities

2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)779

2.1.2.fevaluate the identified risks based on the risk criteria;2

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 2.1 Risk management framework

2.1.2.gidentify and prioritise appropriate risk treatment options and measures;22

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 2.1 Risk management framework

2.1.2.hcontinuously monitor the implementation of the risk treatment measures;13

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 2.1 Risk management framework

2.1.2.iidentify who is responsible for implementing the risk treatment measures and when they should be implemented;3

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 2.1 Risk management framework

2.2.1The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.3

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 2.2 Compliance monitoring

2.2.3The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.12

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 2.2 Compliance monitoring

2.3.1The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.24

Attributes

Section: 2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 2.3 Independent review of information and network security

3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)21178

3.1.1For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.1

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: sqlserver
Sub Section: 3.1 Incident handling policy

3.1.2.cassignment of roles to detect and appropriately respond to incidents to competent employees;3

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: defender
Sub Section: 3.1 Incident handling policy

3.1.2.ddocuments to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.4

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: defender
Sub Section: 3.1 Incident handling policy

3.1.3The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.15

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.1 Incident handling policy

3.2.1The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.16

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.2To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.14

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 3.2 Monitoring and logging

3.2.3.arelevant outbound and inbound network traffic;7

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.bcreation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions;6

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.caccess to systems and applications;9

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.dauthentication-related events;3

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.eall privileged access to systems and applications, and activities performed by administrative accounts;5

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.faccess or changes to critical configuration and backup files;14

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 3.2 Monitoring and logging

3.2.3.gevent logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;13

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.3.huse of system resources, as well as their performance;2

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.2.4The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically. The relevant entities shall ensure that, in case of an alarm, a qualified and appropriate response is initiated in a timely manner.10

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 3.2 Monitoring and logging

3.2.5The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.3

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.2 Monitoring and logging

3.4.1The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.12

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 3.4 Event assessment and classification

3.5.1The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner.3

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.5 Incident response

3.5.3.awith the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification;3

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 3.5 Incident response

3.5.4The relevant entities shall log incident response activities in accordance with the procedures referred to in point 3.2.1., and record evidence.10

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 3.5 Incident response

3.6.2The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.25

Attributes

Section: 3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)
Service: defender
Sub Section: 3.6 Post-incident reviews

4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)928

4.1.1For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.1

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 4.1 Business continuity and disaster recovery plan

4.1.2.frecovery plans for specific operations, including recovery objectives;1

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 4.1 Business continuity and disaster recovery plan

4.1.2.grequired resources, including backups and redundancies;4

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 4.1 Business continuity and disaster recovery plan

4.1.4The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.4

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 4.1 Business continuity and disaster recovery plan

4.2.2.bassurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;1

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 4.2 Backup and redundancy management

4.2.2.erestoring data from backup copies;1

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 4.2 Backup and redundancy management

4.2.2.fretention periods based on business and regulatory requirements.3

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 4.2 Backup and redundancy management

4.3.2.aroles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;3

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 4.3 Crisis management

4.3.2.capplication of appropriate measures to ensure the maintenance of network and information system security in crisis situations.10

Attributes

Section: 4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 4.3 Crisis management

5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)328

5.1.2.athe cybersecurity practices of the suppliers and service providers, including their secure development procedures;21

Attributes

Section: 5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 5.1 Supply chain security policy

5.1.4.fan obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;4

Attributes

Section: 5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 5.1 Supply chain security policy

5.1.7.breview incidents related to ICT products and ICT services from suppliers and service providers;3

Attributes

Section: 5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 5.1 Supply chain security policy

6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)13157

6.1.2.brequirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;5

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.1 Security in acquisition of ICT services or ICT products

6.2.1Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.20

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 6.2 Secure development life cycle

6.2.2.bapply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;19

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 6.2 Secure development life cycle

6.2.2.clay down security requirements regarding development environments;19

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 6.2 Secure development life cycle

6.4.1The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management.10

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 6.4 Change management, repairs and maintenance

6.6.1.asecurity patches are applied within a reasonable time after they become available;3

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.6 Security patch management

6.7.2.bdetermine and apply controls to protect the relevant entities internal network domains from unauthorised access;14

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.7 Network security

6.7.2.enot use systems used for administration of the security policy implementation for other purposes;8

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.7 Network security

6.7.2.gwhere appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities;5

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.7 Network security

6.7.2.iestablish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure;9

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.7 Network security

6.7.2.lapply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.18

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.7 Network security

6.8.2.aconsider the functional, logical and physical relationship, including location, between trustworthy systems and services;2

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.8 Network segmentation

6.9.2For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response software, which is updated regularly in accordance with the risk assessment carried out pursuant to point 2.1 and the contractual agreements with the providers.25

Attributes

Section: 6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 6.9 Protection against malicious and unauthorised software

7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)111

7.2.bthe methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;11

Attributes

Section: 7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:

9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)1066

9.2.ain accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit;9

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.cthe relevant entities approach to key management, including, where appropriate, methods for the following:14

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.c.igenerating different keys for cryptographic systems and applications;6

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.c.iiissuing and obtaining public key certificates;1

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 9.2 Cryptography

9.2.c.iiidistributing keys to intended entities, including how to activate keys when received;3

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.c.ivstoring keys, including how authorised users obtain access to keys;14

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.c.vchanging or updating keys, including rules on when and how to change keys;9

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 9.2 Cryptography

9.2.c.vibacking up or archiving keys;3

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 9.2 Cryptography

9.2.c.viilogging and auditing of key management-related activities;3

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 9.2 Cryptography

9.2.c.xiisetting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.4

Attributes

Section: 9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 9.2 Cryptography

11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)19114

11.1.1For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network and information system security requirements.16

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.1 Access control policy

11.1.2.censure that access is only granted to users that have been adequately authenticated.2

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 11.1 Access control policy

11.2.1The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.2

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.2 Management of access rights

11.2.2.aassign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;9

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.2 Management of access rights

11.2.2.densure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;14

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.2 Management of access rights

11.2.2.fapply logging to the management of access rights.13

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.2 Management of access rights

11.3.1The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.6

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 11.3 Privileged accounts and system administration accounts

11.3.2.aestablish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.3 Privileged accounts and system administration accounts

11.3.2.bset up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;1

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.3 Privileged accounts and system administration accounts

11.3.2.cindividualise and restrict system administration privileges to the highest extent possible,9

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.3 Privileged accounts and system administration accounts

11.3.2.dprovide that system administration accounts are only used to connect to system administration systems.4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.3 Privileged accounts and system administration accounts

11.4.2.bseparate logically such systems from application software not used for system administrative purposes,4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.4 Administration systems

11.4.2.cprotect access to system administration systems through authentication and encryption.4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.4 Administration systems

11.5.2.aset up unique identities for network and information systems and their users;1

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: app
Sub Section: 11.5 Identification

11.5.2.dapply logging to the management of identities.10

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: monitor
Sub Section: 11.5 Identification

11.6.1The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.5

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.6 Authentication

11.6.2.aensure the strength of authentication is appropriate to the classification of the asset to be accessed;4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: entra
Sub Section: 11.6 Authentication

11.6.2.crequire the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;2

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.6 Authentication

11.7.2The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.4

Attributes

Section: 11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 11.7 Multi-factor authentication

12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)436

12.1.2.calign the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.1

Attributes

Section: 12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
Service: keyvault
Sub Section: 12.1 Asset classification

12.2.2.acover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;17

Attributes

Section: 12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 12.2 Handling of assets

12.2.2.bprovide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets;11

Attributes

Section: 12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 12.2 Handling of assets

12.2.2.cprovide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.7

Attributes

Section: 12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)
Service: generic
Sub Section: 12.2 Handling of assets