3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed …

Requirement

The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.

Guidance

• Consider one or more of the following to test the entity’s incident handling policy (indicative, non-exhaustive list):
  • tabletop exercise,
  • simulation of an incident, preferably based on a selected attack scenario based on identified risks and the current threat landscape,
  • red team/blue team exercise and
  • past incident walk-through.
• Test the roles, responsibilities and procedures laid down in the policy at least annually.
• Review and update roles, responsibilities and procedures laid down in the policy at least annually, taking into account the following, in addition to the elements referred to in point 3.1.3 of the Annex to the regulation:
  • results from the policy tests,
  • changes to the threat landscape and cybersecurity legal and regulatory requirements and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures.
• Incident handling policy testing plans or schedules.
• Incident handling policy review plans or schedules.
• Procedure updates (version history), if available.

Tips: guidance

• Identify and consider all internal and external resources required in the event of an incident and ensure their availability at any time:
  • make sure that personnel are properly trained to handle and manage incidents;
  • identify and consider all external stakeholders (e.g. operators, technology suppliers, free and open source (20) project contacts, national competent authorities or CSIRTs) necessary for incident handling.
• Changes in the policy should be communicated to the relevant personnel.
• Ensure a clear overview of the various incident reporting obligations that the entity must fulfil under different reporting regimes.

Tips: examples of evidence

• Detailed procedures for the incident handling policy communicated to personnel as appropriate.
• A list of reporting obligations and deadlines, which may cover both legal and contractual obligations.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -