{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/recitals/78","url":"https://www.headlesslaw.com/nis2/recitals/78","title":"Recital 78","family":"l1_recital_view","work_id":"nis2","view_of":"/nis2/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Directive (EU) 2022/2555, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","valid_from":"2022-12-27","valid_until":null,"content_id":"041a6fcf66524f7e","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/recitals/78/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/recitals/78/versions/2022-12-27/rev/041a6fcf66524f7e","versions_url":"https://www.headlesslaw.com/nis2/recitals/78/versions","relations_url":"https://www.headlesslaw.com/nis2/recitals/78/relations","act_url":"https://www.headlesslaw.com/nis2/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"nis2","path":"/nis2/recitals","name":"NIS2","number":"Directive (EU) 2022/2555","celex":"32022L2555","title_official":null,"document_date":null},"position":{"kind":"recital","key":"78","index":78,"articles":144,"annexes":0},"prev":{"path":"/nis2/recitals/77","key":"77","title":"Recital 77"},"next":{"path":"/nis2/recitals/79","key":"79","title":"Recital 79"},"act_anchor":""}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","check":{"result":"matched","checked_at":"2026-11-01","against":"EUR-Lex"},"repo_path":"spaces/nis2/recitals.md","unit_text_sha256":"d6eb3aca05e091e0f24758fba388947d2415804f56a32ff4b18b635112cdd93e","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"nis2/recitals/rec/78","kind":"recital","key":"78","heading":"","text":"Cybersecurity risk-management measures should take into account the degree of dependence of the essential or important entity on network and information systems and include measures to identify any risks of incidents, to prevent, detect, respond to and recover from incidents and to mitigate their impact. The security of network and information systems should include the security of stored, transmitted and processed data. Cybersecurity risk-management measures should provide for systemic analysis, taking into account the human factor, in order to have a complete picture of the security of the network and information system.","marks":[],"text_hash":"d6eb3aca05e091e0f24758fba388947d2415804f56a32ff4b18b635112cdd93e","revision":1,"blocks":[{"locator":"nis2/recitals/rec/78/block/1","text_hash":"d6eb3aca05e091e0f24758fba388947d2415804f56a32ff4b18b635112cdd93e","revision":1}]}}