[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-h":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-h","Article 21(2)(h)","Cryptography and encryption (Article 21(2)(h))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (h) requires policies and procedures on the use of cryptography and, where appropriate, encryption. Entities need a deliberate approach to protecting data with sound cryptographic methods.\n\n**In practice.** A cryptography policy sets approved algorithms and key lengths, defines where encryption is required for data at rest and in transit, and describes key management through generation, storage, rotation and destruction. Certificates are inventoried and renewed in time, and future needs such as post quantum migration are considered. Evidence includes the policy, key management procedures and certificate and encryption inventories.\n\n**Common gaps.** Key management is often informal, and certificate expiry still causes outages. Many entities lack an inventory of where cryptography is used, which makes algorithm changes hard.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]