Cybersecurity requirements

Essential and important entities should take appropriate and proportionate technical, operational and organisational measures to manage the cybersecurity risks they face and prevent or minimise the impact of incidents on their services and on third-party services.

Such measures shall be based on all-risk planning aimed at protecting the network and information systems and their physical environment, including at least the following measures:

1. Risk analysis and system security processes.
2. Incident handling procedures.
3. Business continuity, such as backup management and disaster recovery, and crisis management.
4. Supply chain security
5. Secure network and information systems, including the management and disclosure of vulnerabilities.
6. Policies and procedures for assessing the effectiveness of cybersecurity risk management measures.
7. Cyber hygiene practices and cybersecurity training
8. Data security through cryptography and encryption
9. Human resources security, access control policies and asset management.
10. Improved identification and authentication.