care este obligația de grijă în NIS2 în limbaj simplu

Ten concrete measures to manage cyber risks

The care obligation means that an organization takes appropriate measures to protect its networks and information systems, and that it can demonstrate which measures it has taken. It is not about a single document or checkbox, but about a set of ten subjects that together form the foundation: from risk analysis and policy to handling suppliers, encryption, access control and what happens in the event of an incident. Any organization subject to the Cybersecurity Act must have organized something on each of those ten subjects — and not only on paper, but also in practice.

Important detail: the care obligation is not a fixed list of mandatory technical products. The word 'appropriate' is decisive here — what is appropriate for a large energy company looks different from what is appropriate for a mid-sized software supplier. The size of the organization, the sensitivity of the data and the risk that a disruption or incident may entail play a role. An overview of care sunt zece măsuri pe care trebuie să le iau conform NIS2 shows how these subjects look in content. Those already working with a management system such as ISO/IEC 27001 will recognize many of these subjects in the control measures of Annex A — although that in itself is no guarantee that the care obligation has been met, as also explained at am nevoie încă de ISO 27001 dacă mă conformez deja cu NIS2.

Where this comes from: Article 21 NIS2 and the Cybersecurity Act

The care obligation and the ten measures are described in Article 21, paragraph 2 of the NIS2 Directive; the Cybersecurity Act transposes this obligation into Dutch law for the organizations that fall under it. The NCSC also provides information on how the care obligation and the reporting obligation relate in practice. Whether an organization must comply with this obligation itself depends on sector and size — this can be determined via cum știu dacă compania mea se încadrează în NIS2.