2.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities shall establish and maintain an appropriate risk management framework to identify and address the risks posed to the security of network and information systems. The relevant entities shall perform and document risk assessments and, based on the results, establish, implement and monitor a risk treatment plan. Risk assessment results and residual risks (12) shall be accepted by management bodies or, where applicable, by persons who are accountable and have the authority to manage risks, provided that the relevant entities ensure adequate reporting to the management bodies.

Guidance

• The entity can use its current risk management framework or adopt a new one (13). A risk management framework is the structured approach used by an entity to identify, assess, manage and mitigate its cybersecurity risks.
• Create a risk treatment plan that associates the identified risks with assets and the measures mitigating the associated risks and takes into account, at least, elements (g) to (h) in point 2.1.2 of the Annex to the regulation. The plan should at least include:
  • a description of the identified risk and how it can negatively affect security objectives;
  • a risk treatment option (for example risk avoidance, risk mitigation, risk transfer or sharing or risk acceptance);
  • the assets associated with the risk;
  • the measures which mitigate the risk;
  • a procedure for assessing the effectiveness of implementation of the measure(s);
  • implementation timelines; and
  • responsible roles.
• Consider residual risks from third parties, for example, data breaches, unaddressed vulnerabilities, regulatory non-compliance from the from the third-party side and over-reliance on a single third party.
• Ensure residual risks are accepted by management bodies or, where applicable, persons who are accountable and have the authority to manage risks, in line with the acceptable residual risk levels of the entity.
• Make sure that management bodies or, where applicable, persons who are accountable and have the authority to manage risks approve the risk-assessment results and risk-treatment plan.

Examples of evidence

• Documented risk management framework.
• Documented results from previous risk assessments.
• Documented risk treatment plan.
• Record of approval of risk assessment results by management bodies or by persons who are accountable and have the authority to manage risks.
• Record of approval of residual risks by management bodies or, where applicable, by persons who are accountable and have the authority to manage risks.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• ENISA -