Protect business email
Short label: EMAIL
Meaning
Combine checks on messages, sender-domain authentication and controls on access to mailboxes.
Why it matters
A fraudulent message can ask a colleague to reveal a password, change a payment or open a harmful attachment.
What you can do
Protect sign-ins, configure domain settings and agree how to verify payment changes. Practise reporting suspicious messages.
Services that can help
Device Shield supports the agreed email and account controls. Workshops help staff practise recognition and reporting; no single check prevents every impersonation attempt.
Official reference — NIS2 Art. 21(2)(j)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(j)
A password alone is not enough: a second factor to log in, and encrypted channels for calls, video, messages and emergencies.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.