NIS2 Documents

Provisions and Requirements

Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management Plan Requirements for Reporting the Results of Business Continuity Management Plan Testing Backup Recovery Parameter Requirements Network and Information Systems Data Loss Time (RPO) Requirements Backup Requirements Human Resources Security Requirements Non-Disclosure Requirements Physical Access Requirements for Network and Information Systems Provisions on Multi-Factor Authentication Solutions Administrator Access Requirements Password Creation and Change Requirements Network and Information Systems Acquisition and Deployment Requirements Provisions on Updating Permitted Software Provisions on the Use of Security Systems Security System Update Requirements Provisions on the Use of Network Filtering Equipment Provisions on the Secure Use of Email Information Classification and Handling Requirements Provisions on the Use of Cryptography and Encryption Risk Assessment Frequency Requirements Requirements for Log Management and Retention, Intrusion Detection and Prevention

Plans

Cyber Incident Management Plan Risk Management Plan Plan for Remediating Non-Conformities Found in the Compliance Assessment Network and Information Systems Business Continuity (Recovery) Management Plan Vulnerability Identification Plan Effectiveness Monitoring Plan

Policies

Network and Information Systems Cybersecurity Policy Human Resources Security and Physical Access Policy

Registers and Forms

Cyber Incident Notification Form Interim Situation Update Report Form Risk Assessment Report Form Cybersecurity Training Report Form Compliance Assessment Report Form List of Permitted Software Cyber Incident (Minor and Significant) Information Form Cyber Incident Investigation Report Form List of Suppliers List of Persons with Administrator Rights Business Continuity Management Plan Test Report Form for Network and Information Systems List of Premises Requiring Protection Network and Information Systems Asset Inventory Cyber Incident Management Plan Test Report Form Vulnerability Detection Report Form Hardware Fault Register Service Provider Risk Assessment Form

Diagrams and Processes

Network and Information Systems Diagram Network and Information Systems Infrastructure Logical Diagram Risk Assessment and Management Process Typical Cyber Incident Management Process

Procedures

Network and Information Systems Risk Assessment and Management Procedure Cryptography and Encryption Use Procedure Cyber Hygiene Practice and Cybersecurity Training Organisation and Delivery Procedure Cybersecurity Requirements Effectiveness Evaluation Procedure Network and Information Systems Acquisition, Development and Maintenance Security Procedure Supply Chain Security Procedure Access Management and Multi-Factor Authentication Measures Asset Management Procedure Patch and Vulnerability Management Procedure Network and Information Systems Change Management Procedure Log Management Procedure

Diagrams and Processes

Network and Information Systems Diagram

A diagram of each network and information system, which KSRA requires the entity to keep and update whenever the system changes.

KSRA

KSRA Chapter II, Section Seven (47)

The Cybersecurity Requirements Description (KSRA, Lithuania's NIS2 implementing rules) requires diagrams of all network and information systems, updated whenever the systems change. The diagrams are prepared together with the system description; the requirements may be set out in one or several documents (KSRA point 3).

Under KSRA, the diagrams must include:

● a diagram of each network and information system (KSRA point 47, Table 3, row 21);
● diagrams updated whenever a system changes (KSRA Table 3, row 21).

The logical infrastructure diagram is described separately.