Essential and important entities should ensure the security of the network and information systems which they use in their activities. Those systems are primarily private network and information systems managed by the essential and important entities’ internal IT staff or the security of which has been outsourced. The cybersecurity risk-management measures and reporting obligations laid down in this Directive should apply to the relevant essential and important entities regardless of whether those entities maintain their network and information systems internally or outsource the maintenance thereof.
Source: Directive (EU) 2022/2555 (NIS2), consolidated EN text (OJ L 333, 27.12.2022, p. 80; Official Journal of the EU). This page is AI-generated legal information, not legal advice. Verify against the Official Journal. Contact: yiango@proton.me