Annex 9.2
Cryptography
Official heading, as published in NIS2 Implementing Regulation.
Read from this provision's own operative text, its duty falls on relevant entities, reaching them through the parent provision this one modifies.
The provision's subject is an artefact, not a person: "The policy and procedures referred to in point 9.1 shall establish", so it states no addressee of its own and elaborates the content of the parent instrument. The parent, Annex 9.1, carries the operative duty: "the relevant entities shall establish, implement and apply a policy and procedures related to cryptography". The class is reached through that parent. The two later occurrences of "the relevant entities" in this text are possessive references to that class's assets and approach, not an addressee formula.
This corpus maps obligations. It does not determine applicability: whether any of these instruments binds a particular organisation turns on facts about that organisation, and none of those facts is in here.
Mapped SPARTA techniques (8)
All 8 mappings on this page were reasoned and reviewed by SafeMode Space. This junction carries no imported cross-references.
What relationship, confidence, and evidence mean
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Disagree with a mapping here? Send a correction. Say which pair and cite the source text you are reading it against; corrections are the fastest way to improve the corpus.
Techniques referencing this article
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Annex 9.2 requires the cryptographic policy to fix the type, strength and quality of the measures, the protocols and algorithms approved for use, and the approach to key management. Those are the choices this technique turns on, and a policy that fixes them badly is what leaves it available. The section mandates that the choices be made and recorded rather than deploying any of them, so it caps at addresses under entry 15, which names this section's parent as its canonical capped case.
Cite as SafeMode Space, Annex 9.2 (NIS2 Implementing Regulation OJ L, 2024/2690, 18.10.2024), https://safemode.space/reference/regulations/nis2-impl/articles/annex-9-2, accessed YYYY-MM-DD. Replace YYYY-MM-DD with the date you read the page; the corpus is curated continuously, so mappings can change between readings. To cite one mapping rather than this page, append its anchor to the URL — every mapping row has an id of the form technique--collection--target, the same on every page that lists it. See how to cite. Sources and licence: sources and attribution. A mapping on this page is interpretive analysis of how a technique and a provision relate, not a statement of law and not compliance guidance. Read the disclaimer.