# Does NIS2 require encryption?

It requires policies and procedures on the use of cryptography and, where appropriate, encryption (Article 21(2)(h)). That means deciding, in writing, where your company uses encryption and how: data in transit (TLS for websites, e-mail and remote access), data at rest (disk encryption on laptops, encrypted backups and databases), and the management of keys and certificates, including who can access them and how they are renewed. Base the choices on current recommendations from your national authority or ENISA, and keep an inventory of where cryptography is used, so you can replace weak algorithms when guidance changes. NetSenX analyses traffic metadata and never decrypts it; where the agent captures packets, on Linux or as a SPAN or TAP sensor, it reads TLS handshakes, which helps show which connections use weak or outdated encryption.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/does-nis2-require-encryption

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Does NIS2 require backups and a business continuity plan?](https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity)
- [What does NIS2 say about supply chain security?](https://netsenx.com/en/faq/what-does-nis2-say-about-supply-chain-security)
- [Does NIS2 require an inventory of IT assets?](https://netsenx.com/en/faq/does-nis2-require-an-asset-inventory)
- [Who supervises NIS2 compliance, and what can the supervisor do?](https://netsenx.com/en/faq/who-supervises-nis2-and-what-can-they-do)
- [Does NIS2 apply to companies based outside the EU?](https://netsenx.com/en/faq/does-nis2-apply-to-companies-outside-the-eu)