NIS2 Documents

Provisions and Requirements

Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management Plan Requirements for Reporting the Results of Business Continuity Management Plan Testing Backup Recovery Parameter Requirements Network and Information Systems Data Loss Time (RPO) Requirements Backup Requirements Human Resources Security Requirements Non-Disclosure Requirements Physical Access Requirements for Network and Information Systems Provisions on Multi-Factor Authentication Solutions Administrator Access Requirements Password Creation and Change Requirements Network and Information Systems Acquisition and Deployment Requirements Provisions on Updating Permitted Software Provisions on the Use of Security Systems Security System Update Requirements Provisions on the Use of Network Filtering Equipment Provisions on the Secure Use of Email Information Classification and Handling Requirements Provisions on the Use of Cryptography and Encryption Risk Assessment Frequency Requirements Requirements for Log Management and Retention, Intrusion Detection and Prevention

Plans

Cyber Incident Management Plan Risk Management Plan Plan for Remediating Non-Conformities Found in the Compliance Assessment Network and Information Systems Business Continuity (Recovery) Management Plan Vulnerability Identification Plan Effectiveness Monitoring Plan

Policies

Network and Information Systems Cybersecurity Policy Human Resources Security and Physical Access Policy

Registers and Forms

Cyber Incident Notification Form Interim Situation Update Report Form Risk Assessment Report Form Cybersecurity Training Report Form Compliance Assessment Report Form List of Permitted Software Cyber Incident (Minor and Significant) Information Form Cyber Incident Investigation Report Form List of Suppliers List of Persons with Administrator Rights Business Continuity Management Plan Test Report Form for Network and Information Systems List of Premises Requiring Protection Network and Information Systems Asset Inventory Cyber Incident Management Plan Test Report Form Vulnerability Detection Report Form Hardware Fault Register Service Provider Risk Assessment Form

Diagrams and Processes

Network and Information Systems Diagram Network and Information Systems Infrastructure Logical Diagram Risk Assessment and Management Process Typical Cyber Incident Management Process

Procedures

Network and Information Systems Risk Assessment and Management Procedure Cryptography and Encryption Use Procedure Cyber Hygiene Practice and Cybersecurity Training Organisation and Delivery Procedure Cybersecurity Requirements Effectiveness Evaluation Procedure Network and Information Systems Acquisition, Development and Maintenance Security Procedure Supply Chain Security Procedure Access Management and Multi-Factor Authentication Measures Asset Management Procedure Patch and Vulnerability Management Procedure Network and Information Systems Change Management Procedure Log Management Procedure

Provisions and Requirements

Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management Plan

Sets out how the network and information systems business continuity management plan is tested, including testing of the recovery time and data loss objectives.

KSRA

KSRA Chapter II, Section Five (27–31)

Under the Cybersecurity Requirements Description (KSRA), testing requirements are part of the network and information systems business continuity (recovery) management plan.

Under KSRA, the plan sets out:

● requirements for testing the plan and the test results report (KSRA points 27.7–27.8);
● testing of the recovery time objective (RTO) and the recovery point objective (RPO) (KSRA points 27.9–27.10);
● testing that backups can be restored (KSRA point 31, Table 2, row 18).

KSI

KSĮ Art. 14(5)(4)

The Law on Cybersecurity (KSĮ) names business continuity as one of the elements of the cybersecurity requirements (KSĮ Art. 14(5)(4)).