Cryptography, encryption and multi-factor authentication
This requirement mandates the use of cryptographic tools and multi-factor authentication (MFA) to protect the confidentiality, integrity, and availability of network and information systems. It ensures that data is unreadable to unauthorized parties and that user identities are verified through multiple independent layers of security.
What it means
Under NIS2, these controls are not "one size fits all" but must be implemented based on a risk assessment. The intent is to move beyond simple password-based security and clear-text data storage, which are insufficient against modern threats like credential theft and data breaches.
In practice, this covers three primary domains: protecting data while it is stored (at rest), protecting data as it moves across networks (in transit), and ensuring that access to critical systems requires more than just a password. The scope extends to all essential services, including administrative interfaces, remote access points, and sensitive databases.
How to meet it
- Implement strong encryption for data at rest using industry-standard algorithms (e.g., AES-256) across servers, backups, and portable media.
- Enforce encrypted communication channels for all data in transit using modern protocols such as TLS 1.2 or 1.3, disabling legacy versions like SSL or early TLS.
- Deploy Multi-Factor Authentication (MFA) for all remote access (VPNs), cloud service portals, and privileged administrative accounts.
- Establish a formal key management process to handle the generation, rotation, storage, and revocation of cryptographic keys.
- Phase out insecure legacy protocols (e.g., Telnet, FTP, HTTP) in favor of their secure counterparts (SSH, SFTP, HTTPS).
- Apply MFA to internal critical systems where a compromise could lead to significant operational disruption or data loss.
Evidence an auditor asks for
- A Cryptography and Key Management Policy defining the approved algorithms and rotation schedules.
- Configuration reports or screenshots demonstrating that MFA is enforced for administrative and remote access accounts.
- Technical documentation or scans showing the use of current TLS versions on public-facing endpoints.
- An inventory of sensitive data stores confirming where encryption at rest has been applied.
Common pitfalls
- Implementing MFA for external users but neglecting it for internal "trusted" administrators or service accounts.
- Using strong encryption algorithms but storing the decryption keys in plain text on the same server as the encrypted data.
- Relying on outdated cryptographic standards (e.g., SHA-1, DES) that are no longer considered secure by regulatory bodies.