Article 8 2

(a)

cybersecurity policy, including measures needed to reach objectives and priorities referred to in Article 6 and paragraph 3 of this Article;

(b)

policies on cybersecurity risk analysis and information system security;

(c)

policy objectives regarding the use of cloud computing services;

(d)

cybersecurity audit, where appropriate, which may include a cybersecurity risk, vulnerability and cyber threat assessment, and penetration testing carried out by a trusted private provider on a regular basis;

(e)

implementation of recommendations resulting from cybersecurity audits referred to in point (d) through cybersecurity and policy updates;

(f)

organisation of cybersecurity, including establishment of roles and responsibilities;

(g)

asset management, including ICT asset inventory and ICT network cartography;

(h)

human resources security and access control;

(i)

operations security;

(j)

communications security;

(k)

system acquisition, development and maintenance, including policies on vulnerability handling and disclosure;

(l)

where possible, policies on the transparency of the source code;

(m)

supply chain security, including security-related aspects concerning the relationships between each Union entity and its direct suppliers or service providers;

(n)

incident handling and cooperation with CERT-EU, such as the maintenance of security monitoring and logging;

(o)

business continuity management, such as backup management and disaster recovery, and crisis management; and

(p)

promotion and development of cybersecurity education, skills, awareness-raising, exercise and training programmes.