Security measures

Essential entities are subject to ex ante and ex post supervision and must submit annually [1] :

• Their description of the measures in place, reflecting the cybersecurity measures in place
• An analysis of the main cyber risk scenarios [2] , in the form of a multiple-choice questionnaire
• A multi-annual action plan detailing the measures planned to ensure a high level of cybersecurity

When setting its supervisory priorities within the meaning of Article 21(1) of the Law, the Institute may, in accordance with a risk-based approach, make certain categories of essential entities subject to the obligation to submit the list of their dependencies on their direct suppliers or service providers. The entities concerned are informed thereof by the Institute within a reasonable period and also submit that list on an annual basis.

Important entities are subject to ex post supervision and are exempt from the regular submission of these deliverables, unless there is evidence, indications, or information suggesting that they are not complying with the NIS 2 Act.

[1] Deadlines and other technical details regarding deliverables are specified in the ILR regulations.

[2] The analysis of key cyber risk scenarios serves as a streamlined oversight tool, limited to a set of predefined scenarios. It does not exempt the entity from conducting its own risk analysis, in accordance with Article 12 of the NIS 2 Act, to identify and address all risks affecting the security of its networks and information systems. The choice of an appropriate risk analysis method is the responsibility of the entity. As part of its supervisory duties, the ILR may request that an entity submit its detailed risk analysis along with evidence demonstrating its effective implementation.