Cyber Security
Risk Management

Check whether your company
falls under
High Criticality or
Other Critical Sectors

If YES

THEN, depending on

	Size
	Sector
	Criticality

Your company falls either under
Essential or Important entity

NIS 2 Directive was published as Directive (EU) 2022/2555

Member States must adopt and publish the measures necessary to comply with the NIS 2 Directive

Member States shall establish a list of essential and important entities

The Commission shall review the functioning of this Directive

• Integrating IT and OT Security for NIS 2 Compliance:
  • Organizations must merge Information Technology and Operational Technology security strategies. This integration is vital due to the expanded attack surface from IT and OT convergence, ensuring cyber threat protection and operational resilience.
• IEC 62443 Standards for OT Security:
  • These standards provide a framework to secure Operational Technology systems, especially in critical infrastructures. Adherence to IEC 62443 enables proactive management of OT-specific risks, the establishment of robust security controls, and maintenance of operational integrity. 

• Policies on risk analysis and information system security
  • Establish processes for regular risk analysis and vulnerabiliy assessment.
  • Conduct asset identification, documentation, and software cataloging.
  • Identify and document current security weaknesses and vulnerabilities.
  • Routinely execute penetration tests on internal infrastructure and existing security implementations.
  • Adopt an Information Security Management System (ISMS) in line with standards like ISO 27001, TISAX, and others.
• Incident handling and management
• Business continuity and crisis management (back‐ups, disaster recovery)
• Supply chain security
• Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
• Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
• Basic cyber hygiene practices and cybersecurity training;
• Policies and procedures regarding the use of cryptography and, where appropriate, encryption;
• Human resources security, access control policies and asset management;
• The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.