CYBERSECURITY HANDBOOK - BEST PRACTICES FOR THE PROTECTION AND RESILIENCE OF NETWORK AND INFORMATION SYSTEMS - June 2021

Nov 4, 2026

Cybersecurity Handbook: Best Practices for the Protection and Resilience of Network and Information Systems provides practical guidance for public sector organizations and medium-to-large private enterprises to strengthen cybersecurity and privacy. It outlines technical and organizational risk management measures and targets information security and IT units, CISOs and DPOs, and specialized professionals. The handbook’s structure follows defense-in-depth controls in eighteen chapters, each describing the control, associated risks, and specialized sub-controls (basic and enhanced).

LanguageEnglish

CategoryTechnology

FormatPDF

Pages76

Reading Time3 h 12 min

AccessFree to download

Preface

Part A – Introduction

1. Security architectures for network and information systems

2. Assessing the risk

Part B – Best Practices

1. Inventory of hardware and software assets

2. Secure configuration of devices and applications

3. Application and services execution control

4. Access control

5. User authentication

6. Network security

7. Malware protection

8. Maintenance and analysis of event logs

9. Web application security

10. Teleworking

11. Use of cryptography

12. Cybersecurity skills and awareness training

13. Supply chain risk management

14. Cybersecurity technical assessments

15. Physical security measures

16. Data backups

17. Incident handling

18. Business continuity and disaster recovery

References

HELLENIC REPUBLIC MINISTRY OF DIGITAL GOVERNANCE NATIONAL CYBERSECURITY AUTHORITY NATIONAL CYBERSECURITY AUTHORITY HELLENIC REPUBLIC CYBERSECURITY HANDBOOK BEST PRACTICES FOR THE PROTECTION AND RESILIENCE OF NETWORK AND INFORMATION SYSTEMS MINISTRY OF DIGITAL GOVERNANCE-GREECE JUNE 2021 THIS HANDBOOK WAS DEVELOPED BY THE NATIONAL CYBER SECURITY AUTHORITY OF GREECE – MINISTRY OF DIGITAL GOVERNANCE-DIRECTORATE FOR CYBER SECURITY STRATEGIC PLANNING-DEPARTMENT FOR REQUIREMENTS AND SECURITY ARCHITECTURE. CYBERSECURITY HANDBOOK CYBERSECUR ITY HANDBOOK 4 TABLE OF CONTENTS PREFACE 6 PART A – INTRODUCTION 1. Security architectures for network and information systems 8 2. Assessing the risk 12 PART B – BEST PRACTICES 1. Inventory of hardware and software assets 14 2. Secure configuration of devices and applications 17 3. Application and services execution control 20 4. Access control 23 5. User authentication 26 6. Network security 29 7. Malware protection 34 8. Maintenance and analysis of event logs 37 9. Web application security 39 10. Teleworking 43 11. Use of cryptography 48 12. Cybersecurity skills and awareness training 51 13. Supply chain risk management 53 14. Cybersecurity technical assessments 56 15. Physical security measures 59 16. Data backups 61 17. Incident handling 63 18. Business continuity and disaster recovery 66 REFERENCES 68 CYBERSECUR ITY HANDBOOK 5 CYBERSECUR ITY HANDBOOK 6 TARGET AUDIENCE STRUCTURE 1 In this handbook the terms "organization",“entity” and "corporation" are considered to have the same meaning and are used interchangeably throughout the text. PREFACE As information and communication technologies create a world of everincreasing complexity in interconnected systems and devices, the public debate on cybersecurity and privacy issues is constantly at the forefront, highlighting the need to strengthen the protection and resilience of these systems from the constantly evolving threats of modern cyberspace. At such a time, the National Cybersecurity Authority of Greece offers acybersecurity handbook containing best practices in technical and organizational risk management measures and addressed to public sector organizations as well as medium and large private enterprises. This handbook is mainly addressed to: a) the information security and IT organizational units of ministries, other public administration entities1 , as well as medium and large private sector enterprises, b) chief information security officers (CISOs), data protection officers (DPOs), as well as other executives who deal with the cybersecurity of network and information systems of public and private sector organizations. In addition, specific categories of professionals, such as software engineers, will find useful specialized content, such as chapter 9 "Web Application Security", while simultaneously teleworking employees of the above organizations are expected to find useful content in chapter 10 "Teleworking". Finally, this handbook, although being a text containing practical instructions, is at the same time addressed to the cybersecurity research community, as well as to people who are generally interested in studying one of the most modern and fascinating scientific fields of our time. The handbook’s contents are organized as follows: Part A: it’s the handbook’s introductory part. Security architectures for modern IT systems are briefly described, as well as the basic steps for organizations for the establishment of a comprehensive information security management system based on risk assessment. Part B: it’s the main body of the handbook. A set of best practices in technical and organizational protection controls is developed, based on the defense-in-depth architecture, which are divided into eighteen (18) chapters that correspond to equivalent security control families. Each chapter adheres to the following structure:

FAQs

Who is the target audience for the Cybersecurity Handbook?

The handbook is mainly addressed to information security and IT organizational units of ministries and public administration entities, as well as medium and large private enterprises. It also targets CISOs, DPOs, executives responsible for cybersecurity, and specialized professionals such as software engineers.

How is the handbook structured across its two parts?

Part A introduces security architectures for modern IT systems and the basic steps for establishing an information security management system based on risk assessment. Part B provides best practices for technical and organizational protection controls, organized into eighteen chapters.

What are basic and enhanced sub-controls?

Basic sub-controls are fundamental measures (marked with the symbol ►) intended to protect against common attack types and should be implemented by every entity. Enhanced sub-controls (also marked with ► in the text) are recommended for critical systems and high-value services and should be implemented based on prior risk assessment and residual risk determination.

Nov 4, 2026

Uploaded by supergirl