2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …

Requirement

The relevant entities shall put in place an effective compliance reporting system which shall be appropriate to their structures, operating environments and threat landscapes. The compliance reporting system shall be capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks.

Guidance

• Set up procedures for compliance monitoring, including (indicative, non-exhaustive list):
  • objectives and a high-level approach to compliance monitoring;
  • relevant security policies that are subject to compliance monitoring;
  • the frequency of compliance reviews;
  • who should carry out compliance reviews (internal or external); and
  • templates for compliance review reports.
• Analyse and evaluate the results of the compliance review.

Examples of evidence

• Documented procedures for monitoring compliance.
• Documented analysis and evaluation of the results, including the current state of the entity’s risk management.
• Detailed compliance monitoring plans, including long-term, high-level objectives and planning.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.