NIS2Art. 21(2)(h)voice-validated
NIS2 Art21h: Art. 21(2)(h)
Network and Information Security Directive 2 (EU 2022/2555)
AL
Founder at SQUR · last verified 2026-10-06
Regulation text
Essential and important entities must implement policies and procedures regarding the use of cryptography and, where appropriate, encryption. This includes key management, cryptographic algorithm selection, transport and storage encryption, and protection of cryptographic material throughout its lifecycle.
ATT&CK techniques this article tests · 15
| Technique | Why it maps | Confidence |
|---|---|---|
| T1003 | 1. Weak key management or inadequate protection of cryptographic material (Art. 21(2)(h)) allows attackers to dump credentials from systems, bypassing security measures. | 90% |
| T1003.001 | 1. Inadequate protection of cryptographic material (Art. 21(2)(h)) can expose memory containing credentials, enabling LSASS dumping by adversaries. | 80% |
| T1003.002 | 1. Poor cryptographic protection of the Security Account Manager (SAM) database (Art. 21(2)(h)) allows attackers to extract hashed credentials. | 80% |
| T1005 | 1. Lack of storage encryption (Art. 21(2)(h)) allows attackers to collect sensitive data directly from local systems without cryptographic barriers. | 90% |
| T1012 | 1. Insecure storage of cryptographic material or keys in the registry (Art. 21(2)(h)) can be discovered and exploited by attackers querying the registry. | 70% |
| T1021 | 1. Inadequate transport encryption (Art. 21(2)(h)) for remote services exposes communication to interception and compromise, facilitating unauthorized access. | 80% |
| T1027 | 1. Attackers may use encryption to obfuscate malicious files or C2 traffic; robust cryptographic policies (Art. 21(2)(h)) can help detect or prevent such misuse. | 70% |
| T1040 | 1. Absence of robust transport encryption (Art. 21(2)(h)) allows attackers to sniff network traffic and capture sensitive data in cleartext. | 90% |
| T1041 | 1. Weak or absent transport encryption (Art. 21(2)(h)) on C2 channels facilitates interception of exfiltrated data, compromising confidentiality. | 80% |
| T1048 | 1. Lack of storage or transport encryption (Art. 21(2)(h)) makes exfiltrated data vulnerable to interception and compromise regardless of the protocol used. | 80% |
| T1056 | 1. Inadequate protection of cryptographic material (Art. 21(2)(h)) can lead to compromise of input capture mechanisms or the data they collect. | 70% |
| T1071.001 | 1. Failure to enforce strong cryptographic algorithm selection and transport encryption (Art. 21(2)(h)) for application layer protocols exposes C2 communications. | 80% |
| T1078 | 1. Weak cryptographic protection of authentication material (Art. 21(2)(h)) can lead to compromise and misuse of valid accounts by adversaries. | 80% |
| T1083 | 1. Lack of storage encryption for sensitive files (Art. 21(2)(h)) increases the impact of file and directory discovery, exposing confidential information. | 80% |
| T1114 | 1. Inadequate transport and storage encryption for email (Art. 21(2)(h)) allows attackers to collect sensitive communications without cryptographic protection. | 70% |
Defending mitigations · 7
| Mitigation | What it does | Confidence |
|---|---|---|
| M1013 | 1. Implementing encryption for data at rest and in transit directly addresses the requirements for transport and storage encryption (Art. 21(2)(h)). | 95% |
| M1015 | 1. Multi-factor authentication mechanisms often rely on strong cryptographic principles for secure token generation and exchange, protecting valid accounts as per Art. 21(2)(h). | 85% |
| M1017 | 1. Secure key management and protection of cryptographic material (Art. 21(2)(h)) are integral to robust user account management, preventing credential compromise. | 80% |
| M1026 | 1. Strict privileged account management protects access to cryptographic material and key management systems, as required by Art. 21(2)(h). | 90% |
| M1035 | 1. Limiting access to cryptographic material and key management infrastructure is a fundamental aspect of protecting cryptographic material throughout its lifecycle (Art. 21(2)(h)). | 90% |
| M1040 | 1. Data Loss Prevention solutions can detect and prevent unauthorized exfiltration of sensitive data, especially if it bypasses or lacks the required encryption (Art. 21(2)(h)). | 80% |
| M1047 | 1. Defense in depth strategies, including cryptographic controls, enhance overall security posture, ensuring protection of cryptographic material (Art. 21(2)(h)). | 85% |
Underlying weaknesses · 6
| CWE | Why it persists | Confidence |
|---|---|---|
| CWE-326 | 1. Selection of weak cryptographic algorithms or insufficient key lengths directly violates the requirement for cryptographic algorithm selection (Art. 21(2)(h)). | 95% |
| CWE-327 | 1. Employing known broken or risky cryptographic algorithms undermines the security objectives of Art. 21(2)(h) regarding algorithm selection. | 95% |
| CWE-311 | 1. Failure to encrypt sensitive data during transport or storage directly contravenes the requirements for encryption (Art. 21(2)(h)). | 90% |
| CWE-312 | 1. Storing sensitive information, including cryptographic material, in cleartext violates the control's mandate for storage encryption and protection (Art. 21(2)(h)). | 90% |
| CWE-319 | 1. Transmitting sensitive information without encryption directly violates the requirement for transport encryption (Art. 21(2)(h)). | 90% |
| CWE-330 | 1. Insufficiently random values used in cryptographic operations, especially key generation, weaken the overall cryptographic strength required by Art. 21(2)(h). | 80% |
What SQUR Covers
Web application + API pentesting for OWASP Top 10, business logic flaws, authentication bypass, injection attacks, and other application-layer vulnerabilities. €1,995 per scan, 24-hour turnaround, EU-only data.
What SQUR Does Not Cover
Internal network pentesting, endpoint security testing, physical security assessments, social engineering, or ICT third-party concentration risk reviews. Engage a complementary provider for those scope items.
Provenance
Mapped Q2.2026 using gemini-2.5-flash · €0.0188 compute · voice-rubric self-validated · 1 hallucination(s) dropped at validation