13.2.3 The relevant entities shall test, review and, where appropriate, update the protection measures …

Requirement

The relevant entities shall test, review and, where appropriate, update the protection measures against physical and environmental threats on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Schedule and perform regular tests, such as quarterly fire drills and annual assessments of physical security measures.
  • Conduct both announced and unannounced tests

Examples of evidence

• Detailed reports of the tests conducted, including objectives, procedures, results and any issues identified.
• Minutes from review meetings detailing discussions, findings and decisions regarding protection measures.

Tips: guidance

• Consider creating a topic-specific policy for protection against physical and environmental threats.
• Deploy periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures
• Consider implementing physically secure storage facilities for high-criticality assets of.

Tips: examples of evidence

• Documented physical and environmental security policy, including a description of facilities and network and information systems in scope.
• Results of periodic simulations and awareness raising activities.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.