13.2.1 For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall …

Requirement

For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall prevent or reduce the consequences of events originating from physical and environmental threats, such as natural disasters and other intentional or unintentional threats, based on the results of the risk assessment carried out pursuant to point 2.1.

Guidance

• Consider risks associated with current and forecasted physical and environmental threats to the network and information systems, where relevant (108).
  • Include in the assessment the (physical) locations of the entity’s facilities.
• Based on the results of the risk assessment determine the assets that need to be protected from physical and environmental threats.

Examples of evidence

• Risk assessment report that includes:
  • identification and evaluation of physical locations, such as data centres, offices and server rooms,
  • analysis of potential physical and environmental threats and
  • mapping of critical assets to physical locations.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -