+6.5.3 The relevant entities shall review and, where appropriate, update their security testing policies …
|
6.5.3 The relevant entities shall review and, where appropriate, update their security testing policies …
RequirementThe relevant entities shall review and, where appropriate, update their security testing policies at planned intervals. Guidance- Review the security testing policy and procedures at least once every two years.
Examples of evidence- Updated security-testing policy and procedures, review comments, and/or change logs.
- Security-testing policy and procedures, including when tests must be carried out, test plans, test cases and test report templates.
Tips: guidance- For systems with external integrations (e.g. cloud services) beyond the organization’s control, ensure that all external application programming interface endpoints are thoroughly tested.
- Determine the auditable security events that are adequate for supporting investigations of security incidents.
- Implement tools for automated testing, such as code analysis tools or vulnerability scanners.
- Ensure the policy is approved by, communicated to and acknowledged by relevant personnel and third parties.
- Ensure that the development and testing environment(s) is/are separate from the production environment.
- Review the security-testing policy and procedures when significant incidents or major changes to the network and information system occur.
Tips: examples of evidence- In addition to the elements referred to in point 6.5.2 (c) of the Annex to the regulation, documented policy that includes at least (indicative, non-exhaustive list):
- approved parties (internal or third);
- confidentiality levels for assessment; and
- test results and the objectives of security assessments and tests.
- Relevant staff aware of the security-testing procedures and tools.
- Documented audit requirements.
- A list of tools used for security testing, including their purpose and how they are maintained and updated.
- Valid licences for commercial testing tools or subscriptions to security services.
- Review showing that the security tools are in use and configured to perform the actions intended.
- Records showing updates to the security policy and procedures based on lessons learnt and new threats.
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|