Does NIS2 require encryption?

It requires policies and procedures on the use of cryptography and, where appropriate, encryption (Article 21(2)(h)). That means deciding, in writing, where your company uses encryption and how: data in transit (TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. for websites, e-mail and remote access), data at rest (disk encryption on laptops, encrypted backups and databases), and the management of keys and certificates, including who can access them and how they are renewed. Base the choices on current recommendations from your national authority or ENISA, and keep an inventory of where cryptography is used, so you can replace weak algorithms when guidance changes. NetSenX analyses traffic metadata and never decrypts it; where the agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, it reads TLS handshakes, which helps show which connections use weak or outdated encryption.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics