LexLint.ioBeta

Know the law your code answers to.

Law / Frameworks / ENISA NIS2 guidance / Policy on the security of network and information systems

ENISA NIS2 guidance 1.1Policy on the security of network and information systems

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall: (a) set out the relevant entities’ approach to managing the security of their network and information systems; (b) be appropriate to and complementary with the relevant entities’ business strategy and objectives; (c) set out network and information security objectives; (d) include a commitment to continual improvement of the security of network and information systems; (e) include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies; (f) be communicated to and acknowledged by relevant employees and relevant interested external parties; (g) lay down roles and responsibilities pursuant to point 1.2; (h) list the documentation to be kept and the duration of retention of the documentation; (i) list the topic-specific policies; (j) lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security; (k) indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).ENISA NIS2 Technical Implementation Guidance, version 1.0, June 2025, with mapping table version 1.2, 1.1

We read each law below as bearing on this requirement. That does not mean the requirement, done well, meets the law: what each law asks is on its own page. Law library as of .

The kinds of duty that reach it: governance, retention.

115
laws
62
jurisdictions
0
with court rulings behind them
6
not yet in force
4
proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

A law in force is unmarked; the rest wear their state: not yet in force proposed

  • Alabama
  • Albania
  • Andorra
  • Australia
  • Austria
  • Belgium
  • Bulgaria
  • Cameroon
  • Canada
  • China
  • Croatia
  • Cyprus
  • Czech Republic
  • Denmark
  • Estonia
  • Ethiopia
  • European Union
  • Finland
  • Florida
  • France
  • Gabon
  • Germany
  • Greece
  • Haiti
  • Hawaii
  • Hungary
  • Iceland
  • Ireland
  • Italy
  • Kansas
  • Kiribati
  • Kuwait
  • Kyrgyzstan
  • Latvia
  • Liechtenstein
  • Lithuania
  • Luxembourg
  • Malta
  • Marshall Islands
  • Michigan
  • Montana
  • Montenegro
  • Morocco
  • Mozambique
  • Netherlands
  • New York
  • North Carolina
  • Peru
  • Poland
  • Portugal
  • Romania
  • Serbia
  • Sierra Leone
  • Slovakia
  • Slovenia
  • Spain
  • Sweden
  • Taiwan
  • Tonga
  • United States
  • Vermont
  • Vietnam

Sector security regimes

91 laws, 46 jurisdictions
JurisdictionLawHow it reaches this requirement
Albania Law No. 25/2024, On Cybersecurity

Through its governance duty. What it requires
Andorra Llei 22/2022, Cybersecurity Risk-Management Obligations

Through its governance duty. What it requires
Austria DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties

Through its governance duty. What it requires
Austria Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria

Through its governance duty. What it requires
Austria Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures

Through its governance duty. What it requires
Belgium Law of 17 February 2022 (Electronic Communications Act Article 105), Ministerial Authorization for 5G Network Elements and Location of 5G Infrastructure

Through its governance duty. What it requires
Belgium Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Bulgaria Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)

Through its governance duty. What it requires
Canada OSFI Guideline B-10, Third-Party Risk Management

Through its governance duty. What it requires
Canada OSFI Guideline B-13, Technology and Cyber Risk Management

Through its governance duty. What it requires
Show the other 81 laws
Canada Prudential supervision of banks: the Office's objects and the Superintendent's directions to a bank

Through its governance duty. What it requires
Croatia Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance

Through its governance duty. What it requires
Cyprus Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Czech Republic Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures

Through its governance duty. What it requires
Czech Republic Decree on the Security Measures of a Provider of a Regulated Service in the Higher-Obligations Regime (Vyhláška č. 409/2025 Sb.)

Through its governance duty. What it requires
Denmark Act on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures

Through its governance duty. What it requires
Denmark NIS 2-loven, Cybersecurity Risk-Management Measures and Registration

Through its governance duty. What it requires
Estonia Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification

Through its governance duty. What it requires
Estonia Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties

Through its governance duty. What it requires
Ethiopia Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from , in 9 months

Through its governance duty. What it requires
European Union Commission Delegated Regulation (EU) 2022/1645, Information Security Management System for Design, Production and Aerodrome Organizations (Part-IS.D.OR)

Through its governance duty. What it requires
European Union Commission Delegated Regulation (EU) 2024/1366, Cybersecurity Network Code for Cross-Border Electricity Flows: Entity Risk Management, Controls and Management System

Through its governance duty. What it requires
European Union Commission Implementing Regulation (EU) 2023/203, Information Security Management System for Aviation Organizations (Part-IS.I.OR)

Through its governance duty. What it requires
European Union DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework

Through its governance duty. What it requires
European Union DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing)

Through its governance duty. What it requires
European Union DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers)

Through its governance duty. What it requires
European Union DORA, Articles 5-16 (ICT Risk Management Framework)

Through its governance duty. What it requires
European Union eIDAS Regulation, Article 19a(1)(a): Risk-Management Measures of Non-Qualified Trust Service Providers

Through its governance duty. What it requires
European Union NIS2 Directive, Cybersecurity Risk-Management Measures

Through its governance duty. What it requires
Finland Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Finland Laki Finanssivalvonnasta, Supervision and Sanctions for the Digital Operational Resilience Regulation

Through its governance duty. What it requires
Finland Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars

Through its governance duty. What it requires
France Projet de loi Résilience des Infrastructures Critiques et Cybersécurité, Cybersecurity Risk-Management Measures (NIS2) proposed

Through its governance duty. What it requires
Germany BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities

Through its governance duty. What it requires
Germany Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures

Through its governance duty. What it requires
Greece Law 5160/2024, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Haiti BRH Circulaire 126, Information Security Rules for Financial Institutions

Through its governance duty. What it requires
Hungary 2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems

Through its governance duty. What it requires
Hungary Cybersecurity Act, Risk-Management Measures

Through its governance duty. What it requires
Iceland Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure

Through its governance duty. What it requires
Ireland European Union (Digital Operational Resilience) (No. 2) Regulations 2025, Competent Authority and Sanctions

Through its governance duty. What it requires
Ireland National Cyber Security Bill, Cybersecurity Risk-Management Measures proposed

Through its governance duty. What it requires
Italy Decreto legislativo 10 marzo 2025, n. 23, DORA Competent Authorities and Regulatory Powers

Through its governance duty. What it requires
Italy Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures

Through its governance duty. What it requires
Italy Determinazione ACN n. 164179 del 14 aprile 2025, Basic NIS Security Measures and Incident Notification

Through its governance duty. What it requires
Kiribati Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set

Through its governance duty. What it requires
Latvia Financial Market Digital Operational Resilience Law, DORA Provisions

Through its governance duty. What it requires
Latvia Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA

Through its governance duty. What it requires
Latvia Ministru kabineta noteikumi Nr. 397, Minimum Cybersecurity Requirements

Through its governance duty. What it requires
Latvia Nacionālās kiberdrošības likums, Cybersecurity Risk-Management Measures

Through its governance duty. What it requires
Liechtenstein Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities

Through its governance duty. What it requires
Lithuania Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures

Through its governance duty. What it requires
Luxembourg Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms

Through its governance duty. What it requires
Luxembourg Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities

Through its governance duty. What it requires
Malta Malta DORA Regulations (S.L. 330.20)

Through its governance duty. What it requires
Malta Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities

Through its governance duty. What it requires
Marshall Islands Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure

Through its governance duty. What it requires
Montenegro Law on Information Security, Essential and Important Entities

Through its governance duty. What it requires
Morocco Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties

Through its retention duty. What it requires
Mozambique Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers

Through its governance duty. What it requires
Netherlands Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details

Through its governance duty. What it requires
Netherlands Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
New York DFS Advisory: Heightened Cybersecurity Risks Associated with Frontier AI Models

Through its governance duty. What it requires
New York DFS Guidance: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks

Through its governance duty. What it requires
New York DFS Guidance: How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation

Through its governance duty. What it requires
New York New York Department of Financial Services Cybersecurity Regulation, Cybersecurity Program and Cybersecurity Policy

Through its governance duty. What it requires
Poland Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions

Through its governance duty. What it requires
Poland Ustawa o krajowym systemie cyberbezpieczeństwa (KSC), System Zarządzania Bezpieczeństwem Informacji from , in 5 months

Through its governance duty. What it requires
Portugal Lei n.º 73/2025, Digital Operational Resilience of the Financial Sector

Through its governance duty. What it requires
Portugal Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Romania DNSC Order 1/2025, Notification for Registration of Essential and Important Entities

Through its governance duty. What it requires
Romania DNSC Order 2/2025, Service-Disruption Criteria and Entity Risk-Level Methodology

Through its governance duty. What it requires
Romania Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures

Through its governance duty. What it requires
Serbia Law on Information Security, ICT Systems of Special Importance and Security Measures

Through its governance duty. What it requires
Sierra Leone Cyber Security and Crime Act, 2021, Critical National Information Infrastructure

Through its governance duty. What it requires
Slovakia Vyhláška NBÚ č. 227/2025 Z. z., Security Measures and Security Documentation

Through its governance duty. What it requires
Slovakia Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures

Through its governance duty. What it requires
Slovenia Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance

Through its governance duty. What it requires
Slovenia ZEKom-2, Operator Security Measures (Articles 115 and 116)

Through its governance duty. What it requires
Spain Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, Cybersecurity Risk-Management Measures proposed

Through its governance duty. What it requires
Spain Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers

Through its governance duty. What it requires
Spain Real Decreto-ley 7/2022 on the Security of 5G Networks and Services, Duties of 5G Operators, Suppliers and Corporate Users

Through its governance duty. What it requires
Spain Real Decreto-ley 8/2023, Article 4, ICT Risk-Management Obligations of Payment System Operators, Payment Processors and Other Technology Providers

Through its governance duty. What it requires
Sweden Cybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory Authorities

Through its governance duty. What it requires
Sweden Cybersäkerhetslag, Cybersecurity Risk-Management Measures

Through its governance duty. What it requires
Sweden Lag (2024:1278), DORA Supplementary Provisions

Through its governance duty. What it requires
Taiwan Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit

Through its governance duty. What it requires
Taiwan Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management

Through its governance duty. What it requires
Taiwan Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans

Through its governance duty. What it requires
Tonga Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set

Through its governance duty. What it requires
United States Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer

Through its retention duty. What it requires

Security baseline statutes

17 laws, 17 jurisdictions
JurisdictionLawHow it reaches this requirement
Alabama Data Breach Notification Act, reasonable security measures and disposal of records

Through its retention duty. What it requires
Cameroon Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)

Through its governance duty. What it requires
China Data Security Law, Data Security Protection Obligations

Through its governance duty. What it requires
Florida Florida Information Protection Act, data security and disposal duty

Through its retention duty. What it requires
Gabon Sécurité des systèmes d'information (dispositions communes)

Through its governance duty. What it requires
Hawaii Destruction of Personal Information Records

Through its retention duty. What it requires
Kansas Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information

Through its retention duty. What it requires
Kuwait Data Classification Policy

Through its governance, retention duties. What it requires
Kyrgyzstan Digital Code, digital resilience baseline security measures

Through its governance duty. What it requires
Michigan Identity Theft Protection Act, destruction of data no longer needed

Through its retention duty. What it requires
Show the other 7 laws
Montana Impediment of Identity Theft, record destruction duty

Through its retention duty. What it requires
Montenegro Law on Information Security, General Security Measures

Through its governance duty. What it requires
Mozambique Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector

Through its governance duty. What it requires
North Carolina Identity Theft Protection Act, destruction of personal information records

Through its retention duty. What it requires
Peru Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed

Through its governance duty. What it requires
Vermont Document Safe Destruction Act, safe destruction of records containing personal information

Through its retention duty. What it requires
Vietnam Cybersecurity Law, Information System Classification and Protection Measures

Through its governance duty. What it requires

Product security requirements

7 laws, 6 jurisdictions
JurisdictionLawHow it reaches this requirement
Australia Security Standards for Smart Devices

Through its governance duty. What it requires
Austria Cybersicherheitszertifizierungs-Gesetz (CSZG), Supervision of European Cybersecurity Certification

Through its governance duty. What it requires
China Cybersecurity Law, Network Product and Service Security Duties

Through its governance duty. What it requires
Czech Republic Cybersecurity Act (Zákon o kybernetické bezpečnosti), Cybersecurity Certification: Authorisation, Suspension and Offences

Through its governance duty. What it requires
European Union Cyber Resilience Act, Obligations of Open-Source Software Stewards from , in 14 months

Through its governance duty. What it requires
European Union European Health Data Space Regulation, Essential Requirements for the Harmonised Software Components of EHR Systems from , in 2.4 years

Through its governance duty. What it requires
Greece Law 4961/2022 (Ν. 4961/2022), Chapter Γ' of Part B, Cybersecurity of Internet of Things Devices

Through its governance duty. What it requires

Section titles and the first point of each of the ENISA NIS2 Technical Implementation Guidance, CC BY 4.0. ENISA Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, version 1.0 (June 2025), © European Union Agency for Cybersecurity (ENISA), 2025, licensed under CC BY 4.0. The section titles and requirement text are the Annex to Implementing Regulation (EU) 2024/2690 as ENISA prints it (© European Union); each section carries its first point as its text, and ENISA's guidance, examples of evidence and tips are not reproduced. Every requirement of the framework.