Dispune întreprinderea de o politică pentru analiza riscurilor și asigurarea securității sistemelor informatice?

Risk analysis policy is the foundation for the other nine measures

Yes, in most cases there is something to say about this, because risk analysis is mentioned as the first measure in Article 21(2) NIS2 and is therefore the foundation on which the rest of the policy rests. The question not only tests whether a document "risk policy" exists, but whether the company systematically checks which information systems and processes are vulnerable, and what measures are in place to address them. A customer asking this question essentially wants to know whether security is based on a risk assessment or is ad hoc.

In practice, this field is often difficult to answer with a simple yes, because risk analysis is usually not a separate policy document but is intertwined with other components: is access policy established, including the management of business assets, is there a process for identifying and remedying vulnerabilities, and is the effectiveness of security measures periodically assessed. Without an underlying document describing the risk assessment — even if it is a simple internal overview — a "yes" here cannot be substantiated. If that section is missing, then "no" or "partially" is the honest answer, possibly with an explanation of which parts are already in place.

Where this precisely follows from Article 21(2)

Article 21(2)(a) of Directive (EU) 2022/2555 mentions "policies on risk analysis and information systems security" as the first of ten mandatory measures, and is therefore the most direct reference for this question. The directive itself does not specify how a risk analysis should be set up — that detail is left to national implementation rules or to standards such as ISO 27001, which incidentally is different from this policy question: see is the company ISO 27001 certified. To find out whether the company itself is already subject to the directive, see is the company subject to the NIS2 Directive or its national implementation.