The European Union Agency for Cybersecurity (ENISA) has published new guidance to support key digital infrastructure and ICT providers in implementing NIS2. The NIS2 Technical Implementation Guidance covers 13 areas, including incident handling and business continuity & crisis management.
The guidance is directed at digital infrastructure, ICT service management, and digital providers sectors as mandated by NIS2, but may also aid other private and public organizations seeking to enhance cybersecurity.
Following NIS2’s push for a harmonised EU-wide cybersecurity baseline, ENISA worked closely with the European Commission and national authorities. It builds on the Implementing Regulation’s annex by offering actionable advice, real-world evidence examples, and mappings to industry best practices, standards, and frameworks.
Incident handling
Incident handling is a detailed section which focuses on establishing robust incident handling processes: policy, roles, detection, reporting, analysis, and lessons learned. It must be coherent with the business continuity arrangements.
Business continuity & crisis management
Aligning to ISO 22301, ISO 22313, and NIST SP 800-34 Rev. 1, the business continuity and crisis management information contains no surprises for business continuity professionals. It encourages risk-informed business continuity plans covering continuity strategies, recovery time objectives, roles, and communications during crises.
