Securing your organisation

Essential entities are subject to ex ante and ex post supervision and must submit annually [1] :

• An analysis of the main cyber risk scenarios [2] , in the form of a multiple-choice questionnaire
• Their security objectives, reflecting the cybersecurity measures in place
• An action plan detailing the measures planned to ensure a high level of cybersecurity

Important entities are subject to ex post supervision and are exempt from the regular submission of these deliverables, unless there is evidence, indications, or information suggesting that they are not complying with the NIS 2 Act.

[1] Deadlines and other technical details regarding deliverables are specified in the ILR regulations.

[2] The analysis of key cyber risk scenarios serves as a streamlined oversight tool, limited to a set of predefined scenarios. It does not exempt the entity from conducting its own risk analysis, in accordance with Article 12 of the NIS 2 Act, to identify and address all risks affecting the security of its networks and information systems. The choice of an appropriate risk analysis method is the responsibility of the entity. As part of its supervisory duties, the ILR may request that an entity submit its detailed risk analysis along with evidence demonstrating its effective implementation.