what to put in place
The controls that most of these rules ask for, one page each: what it is, what to look for when you choose, where it goes wrong and the proof it leaves. No product is named or recommended.
- multi-factor authenticationA second proof of identity at sign-in, so a stolen password alone does not get anyone in. NIS2 names it directly. The other rules expect strong authentication and leave the method to you.
- asset inventoryA list of the systems, devices, applications and data stores the company runs, each with an owner. Every other control starts from it, because nobody can protect, patch or recover what is not on the list.
- risk registerA short written list of what could go wrong, how bad it would be, who owns it and what was decided. It is the document that lets you show your measures fit the risk, and the reason to do less where the risk is low.
- supplier managementA register of the suppliers that hold your data or run part of your service, a check in proportion to what each can affect, and contract terms that carry security. NIS2, DORA and GDPR all ask for it, and DORA asks for the most.
- awareness trainingA short, repeated programme that teaches the whole staff what to spot, what to report and what the company's own rules are. The rules ask for the training and leave the length to you. What auditors look for is the record.
- incident managementA written way to spot an incident, call it, contain it, report it and learn from it, with named roles. The rules ask for the process and set clocks for reporting. The tool is a place to keep the record.
- logging and monitoringKeeping records of what happens on your systems and watching them for signs of trouble. NIS2 does not list monitoring as a measure of its own. It is the part that makes incident handling and access control possible to show.
- backup and recoveryCopies of your data and systems that you can bring back, in a time you chose. NIS2 names backups and disaster recovery. DORA spells out policy, testing and a separate place to restore.
- endpoint managementOne console that configures, updates, encrypts and, if needed, wipes the company laptops and phones. It carries parts of several rules, and it needs the protection of an administrator account.
- encryption and key managementEncryption protects data only as long as the keys are safe and recoverable. NIS2 asks for a policy on cryptography and encryption, DORA names key protection, GDPR names encryption of personal data.
- vulnerability managementKnowing what is exposed, deciding how fast each flaw gets fixed and showing that it was. NIS2 names vulnerability handling, DORA names the testing, and the CRA sets update duties for product makers.
- secure developmentBuilding security into software during design, coding, testing and release, and checking what you buy. NIS2 asks for it, the CRA sets requirements for products, and the AI Act does for high-risk AI systems.
- vulnerability disclosureA published way for outsiders to tell you about a flaw, and a process for what you do with the report. NIS2 names disclosure, and the CRA requires a coordinated disclosure policy and a contact from product makers.
- privileged accessControl of the accounts that can change systems, read everything or switch protections off. The rules ask for strong sign-in, separate admin accounts and regular review of who holds the rights.
- access reviewsThe cycle that keeps access matched to people: what happens when someone joins, moves or leaves, and the periodic review where each system owner signs off who still needs access.
- single sign-on and directoryThe one place where identities live and where the decision to let someone in is made. It makes joiners, leavers and MFA enforceable in one spot, and it becomes the system you cannot afford to lose.
- software bill of materials and component checksA list of the software components inside what you build or buy, and the habit of checking it against new vulnerabilities. The CRA requires the list from manufacturers. For everyone else it is a practice that makes the supplier and patching rules answerable.
- AI inventoryA register of the AI tools and uses in your company, with an owner, a purpose, the data involved and the rules for each. No text requires the register itself. Without it you cannot tell which AI Act duties apply to you.