Practical implementation · Annex I
QNRCS
Annex I presents the QNRCS, a national reference structure for organising cybersecurity management throughout its life cycle.
Framework
To whom it applies.
You can support any organization. For essential and important entities, it shall be combined with the minimum applicable measures.
Simple Reading
Five essential points.
- Organizes cybersecurity by goals Manage, Identify, Protect, Detect, Answer and Recover
- Fold objectives into categories and controls
- Consider people, processes and technology
- It relates checks to recognized standards and good practices
- Helps structure continuous improvement and internal communication
Start without complicating
Four practical steps.
- 01
Set scope
Identify the services, processes and systems on which the NQRCS will be applied.
- 02
Map what exists
Relating policies, processes, technologies and responsible for the six objectives.
- 03
Identify gaps
Check missing, incomplete or no verifiable evidence.
- 04
Prioritize and review
First address the most relevant risk and periodically review the state of the controls.
Proof
Which should be organized.
- Map of controls and responsible persons
- Risk assessments and decisions
- Operational policies, procedures and records
- Improvement plan and review results
Warning
Avoid wrong readings.
- Do not treat QNRCS as an isolated checklist.
- Do not confuse voluntary reference with exemption from mandatory measures.
- Do not consider a control completed without execution and evidence.
Frequently Asked Questions
Two straight answers.
The QNRCS It's a certification?
No. It is a national reference framework that organizes cybersecurity objectives, categories and controls.
Apply QNRCS replace Annex III?
No. For key and important entities, the implementation of the NQRCS must be combined with the minimum measures applicable.
Primary source
Regulation No. 756/2026 of 22 June
Information guide and simplified. To apply a measure or interpret a criterion, always confirm the full text of the official act.