[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-a":3},{"item":4,"lessons":16,"controls":43,"related":61},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-a","Article 21(2)(a)","Policies on risk analysis and information system security (Article 21(2)(a))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (a) requires entities to have policies on risk analysis and on the security of information systems. These policies form the foundation for the other risk management measures in Article 21.\n\n**In practice.** The entity has an approved information security policy and a documented risk assessment method covering how risks are identified, analysed, evaluated and treated. Risk assessments are performed regularly and after significant changes, with results driving a treatment plan approved by management. Evidence includes the policy set, the risk methodology, recent assessments and the risk register.\n\n**Common gaps.** Policies are often generic templates not reflecting how the organisation actually works. Risk assessments may be outdated or disconnected from operational and investment decisions.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},6,[19,23,27,31,35,39],{"slug":20,"title":21,"published_at":22},"germany-expands-spy-agency-cyber-powers-what-organizations-must-understand","Germany Expands Spy Agency Cyber Powers: What Organizations Must Understand","2026-11-13T17:20:22.404+00:00",{"slug":24,"title":25,"published_at":26},"facial-recognition-misuse-highlights-governance-gaps-and-training-failures-in-uk-policing","Facial Recognition Misuse Highlights Governance Gaps and Training Failures in UK Policing","2026-11-13T11:21:16.575+00:00",{"slug":28,"title":29,"published_at":30},"fatf-exposes-100m-crypto-laundering-trail-behind-global-scam-networks","FATF Exposes $100M Crypto Laundering Trail Behind Global Scam Networks","2026-11-12T13:20:40.019+00:00",{"slug":32,"title":33,"published_at":34},"municipality-reprimanded-for-deploying-ai-in-nursing-home-without-adequate-dpia","Municipality Reprimanded for Deploying AI in Nursing Home Without Adequate DPIA","2026-11-11T12:22:06.148+00:00",{"slug":36,"title":37,"published_at":38},"shared-malware-ecosystem-links-three-china-nexus-espionage-campaigns-against-critical-sectors","Shared Malware Ecosystem Links Three China-Nexus Espionage Campaigns Against Critical Sectors","2026-11-10T20:23:22.453+00:00",{"slug":40,"title":41,"published_at":42},"irelands-cyber-unpreparedness-highlights-the-cost-of-delayed-nis2-transposition","Ireland's Cyber Unpreparedness Highlights the Cost of Delayed NIS2 Transposition","2026-11-10T13:21:14.597+00:00",[44,49,53,57],{"slug":45,"name":46,"problem":47,"stories":48},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":50,"name":51,"problem":52,"stories":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56,"stories":48},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":58,"name":59,"problem":60,"stories":48},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[62,68,73,77,81,85,90,94],{"family":63,"item":64,"code":65,"title":66,"together":67},"gdpr","35","Article 35","Data protection impact assessment",2,{"family":69,"item":70,"code":71,"title":72,"together":67},"nist-csf","gv-po","GV.PO-01","GV.PO: Policy",{"family":69,"item":74,"code":75,"title":76,"together":67},"de-cm","DE.CM-1","Continuous Monitoring",{"family":63,"item":78,"code":79,"title":80,"together":48},"25","Article 25","Data protection by design and by default",{"family":63,"item":82,"code":83,"title":84,"together":48},"9","Article 9","Processing of special categories of personal data",{"family":86,"item":87,"code":88,"title":89,"together":48},"iso-27001","a-5-36","Annex A 5.36","Compliance with policies, rules and standards for information security",{"family":63,"item":91,"code":92,"title":93,"together":48},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":86,"item":95,"code":96,"title":97,"together":48},"a-5-6","Annex A 5.6","Contact with special interest groups"]