Does NIS2 require network monitoring?
NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. does not name network monitoring or NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker., but Article 21 lists incident handling among the required risk-management measures, and Article 23 requires significant incidents to be reported on a fixed timeline. You cannot report an incident you have not detected, so continuous network monitoring is one practical way to meet both.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
This answer also appears, with more context, here: NIS2 network monitoring
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.