[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-b":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (b) requires entities to have measures for incident handling, meaning the processes to prevent, detect, analyse, contain, respond to and recover from incidents. It links closely to the reporting obligations in Article 23.\n\n**In practice.** The entity has an incident handling policy and procedures, defined roles, criteria for classifying incidents, and tooling to detect and log events. Incidents are recorded, analysed for root cause and used for improvement, and the process includes steps to assess whether an incident is significant and must be reported. Evidence includes procedures, incident logs, post incident reviews and exercise records.\n\n**Common gaps.** Incident handling often lacks a clear path to decide significance for regulatory reporting. Small incidents are not logged, which hides trends.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},1257,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"faa-communications-failure-halts-all-us-flights","FAA Communications Failure Halts All U.S. Flights","2026-11-13T22:20:21.497+00:00",{"slug":24,"title":25,"published_at":26},"microsoft-365-outage-exposes-risks-of-unvalidated-network-changes","Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes","2026-11-13T20:20:57.119+00:00",{"slug":28,"title":29,"published_at":30},"qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington","Qilin Ransomware Steals Personal Data from University of Texas at Arlington","2026-11-13T18:20:39.241+00:00",{"slug":32,"title":33,"published_at":34},"ransomware-encrypts-cloud-providers-infrastructure-disrupting-customers-for-days","Ransomware Encrypts Cloud Provider's Infrastructure, Disrupting Customers for Days","2026-11-13T15:20:40.884+00:00",{"slug":36,"title":37,"published_at":38},"record-uk-cyber-incident-reports-highlight-data-extortion-surge","Record UK Cyber Incident Reports Highlight Data Extortion Surge","2026-11-13T13:23:12.232+00:00",{"slug":40,"title":41,"published_at":42},"operation-tornado-354-dark-web-criminals-arrested-through-persistent-law-enforcement-intelligence-ga","Operation TorNado: 354 Dark Web Criminals Arrested Through Persistent Law Enforcement Intelligence Gathering","2026-11-13T12:21:18.576+00:00",{"slug":44,"title":45,"published_at":46},"ai-agent-containment-requires-more-than-pulling-the-plug","AI Agent Containment Requires More Than Pulling the Plug","2026-11-13T12:20:44.927+00:00",{"slug":48,"title":49,"published_at":50},"operation-endgame-dismantles-malware-as-a-service-infrastructure-stealing-millions-of-credentials","Operation Endgame Dismantles Malware-as-a-Service Infrastructure Stealing Millions of Credentials","2026-11-13T11:20:42.574+00:00",{"slug":52,"title":53,"published_at":54},"north-korean-hackers-steal-6b-from-binance-using-crypto-obfuscation-chains","North Korean Hackers Steal $6B from Binance Using Crypto Obfuscation Chains","2026-11-13T11:20:22.826+00:00",{"slug":56,"title":57,"published_at":58},"microsofts-november-patch-tuesday-breaks-windows-activation","Microsoft's November Patch Tuesday Breaks Windows Activation","2026-11-13T10:21:11.124+00:00",{"slug":60,"title":61,"published_at":62},"global-dark-web-crackdown-nets-354-arrests-and-210m-in-assets","Global Dark Web Crackdown Nets 354 Arrests and €210M in Assets","2026-11-13T09:20:58.871+00:00",{"slug":64,"title":65,"published_at":66},"japans-cyberattack-surge-highlights-gaps-in-vulnerability-management-and-ai-assisted-threat-detectio","Japan's Cyberattack Surge Highlights Gaps in Vulnerability Management and AI-Assisted Threat Detection","2026-11-12T21:21:33.229+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",505,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",487,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",365,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",251,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",165,{"slug":94,"name":95,"problem":96,"stories":97},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",112,[99,105,111,117,123,129,134,140],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",1172,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",1125,{"family":112,"item":113,"code":114,"title":115,"together":116},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",1120,{"family":118,"item":119,"code":120,"title":121,"together":122},"cis","7","Control 7","Continuous Vulnerability Management",774,{"family":124,"item":125,"code":126,"title":127,"together":128},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",650,{"family":118,"item":130,"code":131,"title":132,"together":133},"17","Control 17","Incident Response Management",578,{"family":135,"item":136,"code":137,"title":138,"together":139},"mitre-attack","t1566","T1566","Phishing",456,{"family":141,"item":142,"code":143,"title":144,"together":145},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",333]