[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-b":3},{"item":4,"lessons":16,"controls":23,"related":36},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (b) requires entities to have measures for incident handling, meaning the processes to prevent, detect, analyse, contain, respond to and recover from incidents. It links closely to the reporting obligations in Article 23.\n\n**In practice.** The entity has an incident handling policy and procedures, defined roles, criteria for classifying incidents, and tooling to detect and log events. Incidents are recorded, analysed for root cause and used for improvement, and the process includes steps to assess whether an incident is significant and must be reported. Evidence includes procedures, incident logs, post incident reviews and exercise records.\n\n**Common gaps.** Incident handling often lacks a clear path to decide significance for regulatory reporting. Small incidents are not logged, which hides trends.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},1,[19],{"slug":20,"title":21,"published_at":22},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",[24,28,32],{"slug":25,"name":26,"problem":27,"stories":17},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":29,"name":30,"problem":31,"stories":17},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":33,"name":34,"problem":35,"stories":17},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[37,42,46,51,56,61],{"family":38,"item":39,"code":40,"title":41,"together":17},"cis","17","Control 17","Incident Response Management",{"family":38,"item":43,"code":44,"title":45,"together":17},"7","Control 7","Continuous Vulnerability Management",{"family":47,"item":48,"code":49,"title":50,"together":17},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",{"family":52,"item":53,"code":54,"title":55,"together":17},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":57,"item":58,"code":59,"title":60,"together":17},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",{"family":62,"item":63,"code":64,"title":65,"together":17},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software"]