2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …

Requirement

and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.

Guidance

• Analyse and evaluate the results of the independent review.
• Report results to management bodies.
• Use a standardized report format for reporting to the management bodies. Consider the following elements (indicative, non-exhaustive list):
  • executive summary, including the scope and key findings,
  • methodology,
  • detailed findings, including gaps identified and non-compliance issues,
  • recommendations and
  • conclusions.
• Reports are generated and presented to management bodies at least annually.
• Take corrective actions or justify, accept and document residual risks.
• The outcomes of independent reviews should be systematically reflected in the risk assessment results and risk treatment plans (Annex to the regulation, point 2.1). Specifically, when a risk is identified or reassessed through an independent review, the corresponding risk assessment should be updated accordingly. This ensures that the risk profile remains accurate and that any emerging or evolving risks are adequately captured and addressed in the overall risk management framework.

Examples of evidence

• Documented analysis and evaluation of the results, including any residual risks.
• Minutes from past reviews.
• Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
• Documentation of any corrective actions.
• Budget approval for any corrective actions.
• The most recent results of compliance monitoring and auditing.
• Records from updated risk register.

Mapping to standards and frameworks

1. Přehled

1.1 Odkazy

• GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
• ID.IM-01 Improvements are identified from evaluations
• ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
• ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
• ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.