6.7.3 The relevant entities shall review and, where appropriate, update these measures at planned …

Requirement

The relevant entities shall review and, where appropriate, update these measures at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Although the frequency of reviews of network security measures depends on the entity’s risk assessment as a general rule the entity might (indicative, non-exhaustive list):
  • continuously monitor the networks for real time threats;
  • perform scans for new vulnerabilities weekly;
  • review and possibly update the rules of the firewall and other tools monthly; and
  • thoroughly assess the entire network annually.
• Review logs or records of all changes made to the network security rules, including details of the changes, approvals and implementation dates.
• Ensure that these reviews are conducted regularly and documented comprehensively.

Examples of evidence

• Plans or schedules for upcoming or completed, regular or ad hoc reviews.
• List of reports from past reviews. This should cover various types of reviews.
• Logs from firewalls, routers and other network devices showing access attempts, configuration changes and other relevant activities.
• Reports from SIEM and EDR/XDR systems showing aggregated and analysed security events.
• Virtual private network (VPN) and remote access logs showing remote access, including OOB connections, access attempts, successful connections and any anomalies.
• Evidence of network access control (NAC) or other similar and/or alternative solutions, in place, including logs and configuration settings.
• Logs or records showing the dates and results of regular reviews of the network security rules.
• Logs or records of all changes made to the network security rules.
• Logs or records of firewall and ACL reviews.
• Documentation showing regular reviews of user and administrative access to network devices.
• Audit logs from network security devices (e.g. firewalls, intrusion detection/prevention systems (IDS/IPS)) to ensure that changes and reviews are logged.
• Backup files of network device configurations to ensure that changes and reviews are reflected in the backups.
• Logs of network security incidents to see if they include documentation of rule set reviews following significant incidents.
• Post incident review reports to see if they document reviews and any necessary adjustments to the network security rules.

Tips: guidance

• Communicate to personnel the correct usage of mobile devices, including the entity’s connected vehicles and other remote accesses.
• Where appropriate, apply solutions capable of collecting, analysing and detecting all anomalies, exfiltrations, intrusions and the most sophisticated threats.

Tips: examples of evidence

• The correct usage of mobile devices and other remote accesses (e.g. teleworking and VPN) has been communicated to personnel.
• Existence of IDS/IPS.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -