EU Directive 2022/2555 on Network and Information Security
EU-wide cybersecurity legislation requiring essential and important entities to implement risk-management measures, report significant incidents, and submit to supervisory oversight. Covers 10 mandatory security domains under Article 21 including incident handling, business continuity, supply chain security, and cryptography.
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| Art. 21(2)(a) | Policies on risk analysis and information system security | |
| Art. 21(2)(b) | Incident handling | |
| Art. 21(2)(c) | Business continuity, such as backup management and disaster recovery, and crisis management | |
| Art. 21(2)(d) | Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers | |
| Art. 21(2)(e) | Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure | |
| Art. 21(2)(f) | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | |
| Art. 21(2)(g) | Basic cyber hygiene practices and cybersecurity training | |
| Art. 21(2)(h) | Policies and procedures regarding the use of cryptography and, where appropriate, encryption | |
| Art. 21(2)(i) | Human resources security, access control policies and asset management | |
| Art. 21(2)(j) | The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate | |
| Art. 23 | Reporting obligations (early warning within 24h, incident notification within 72h, final report within one month) | |
| Art. 24 | Use of European cybersecurity certification schemes | |
| Art. 29 | Cybersecurity information-sharing arrangements | |
| Art. 32 | Supervisory and enforcement measures for essential entities |