NIS2 Cryptography Requirements: Implementing Encryption That Meets Article 21 Standards

Article 21(2)(h) of NIS2 explicitly requires "policies and procedures regarding the use of cryptography and, where appropriate, encryption." This is one of the most specific technical requirements in the directive, and it demands more than just enabling HTTPS. You need comprehensive cryptographic policies, proper key management, and evidence that your encryption implementation is actually effective.

NIS2 Cryptography Scope

Your cryptography policy must cover:

• Data in transit — TLS for all network communication, including internal service-to-service
• Data at rest — Encryption of stored data, databases, backups, and object storage
• Data in use — Where applicable, confidential computing or secure enclaves
• Key management — Key generation, storage, rotation, and destruction procedures
• Certificate management — PKI infrastructure, certificate lifecycle, automated renewal
• Cryptographic algorithm selection — Approved algorithms, minimum key lengths, deprecation schedules

Implementation: Data in Transit

Enforce TLS 1.3 everywhere. Disable TLS 1.0, 1.1, and ideally 1.2 where possible. In Kubernetes, deploy a service mesh (Istio, Linkerd) for automatic mutual TLS between services. Use cert-manager for automated certificate provisioning from Let's Encrypt or your internal CA. Monitor certificate expiration and alert at 30, 14, and 7 days.

Implementation: Data at Rest

Use AES-256-GCM for symmetric encryption. Enable encryption at the storage layer — cloud provider-managed or customer-managed keys (CMK). For sensitive workloads, use customer-managed keys stored in an HSM (AWS CloudHSM, Azure Dedicated HSM, or HashiCorp Vault with HSM backend). Encrypt Kubernetes secrets with KMS provider encryption at the etcd level.

Key Management Architecture

Key management is where most organizations fail NIS2 audits. Requirements:

• Separation of duties — Key administrators cannot access encrypted data, and vice versa
• Automated rotation — Rotate encryption keys on schedule (90 days for data keys, annually for master keys)
• Secure storage — Master keys in HSM or dedicated key management service
• Audit trail — Every key operation logged and auditable
• Key destruction — Cryptographic erasure when data retention periods expire

HashiCorp Vault is the de facto standard for secrets and key management in platform engineering. Deploy it in high-availability mode, back it with an HSM for the unseal key, and use dynamic secrets wherever possible.

Post-Quantum Readiness

While not yet required by NIS2, post-quantum cryptography is on the horizon. NIST has finalized ML-KEM (Kyber) for key encapsulation and ML-DSA (Dilithium) for digital signatures. Start inventorying your cryptographic dependencies. Identify systems using RSA or ECDSA that will need migration. Plan for crypto-agility — the ability to swap algorithms without redesigning systems.

What Open Empower Delivers

We implement comprehensive cryptographic infrastructure: TLS automation, key management with Vault, encrypted storage, certificate lifecycle management, and post-quantum readiness assessment. Your NIS2 cryptography policy backed by actual infrastructure, not just documentation.