2.3.1 The relevant entities shall review independently their approach to managing network and information …

Requirement

The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.

Guidance

• Make sure that the independent review is conducted by a person or persons with the appropriate competences (indicative, non-exhaustive list):
  • cybersecurity technical knowledge, for example cybersecurity frameworks (ISO/IEC 27001, National Institute of Standards and Technology (NIST) cybersecurity framework, etc.),
  • industry knowledge,
  • risk assessment skills,
  • compliance and regulatory knowledge, for example the NIS2 Directive, the GDPR and the Digital Operational Resilience Act,
  • good understanding of good practices in auditing and
  • good understanding of when technical certification and conformance are required and must be documented in the conformance and compliance report, to ensure that global standards are implemented correctly.

Examples of evidence

• Documented results of the review or audit.
• Evidence of the competences of the independent reviewers, for example professional experience and academic qualifications, certifications such as certified information systems auditor, certified information systems security professional, certified information security manager, etc.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -