+3. Incident handling
---+3.1 Incident handling policy
------+3.1.1 For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities …
------+3.1.2 The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster …
------+3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed …
---+3.2 Monitoring and logging
------+3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on …
------+3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in …
------+3.2.3 Based on the procedures referred to in point 3.2.1., the relevant entities shall maintain, document …
------+3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the …
------+3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect …
------+3.2.6 To the extent feasible, the relevant entities shall ensure that all systems have synchronised time …
------+3.2.7 The procedures as well as the list of assets that are being logged shall be reviewed and, where …
---+3.3 Event reporting
------+3.3.1 The relevant entities shall put in place a simple mechanism allowing their employees, suppliers and …
------+3.3.2 The relevant entities shall, where appropriate, communicate the event reporting mechanism to their …
---+3.4 Event assessment and classification
------+3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents …
------+3.4.2 For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) carry …
---+3.5 Incident response
------+3.5.1 The relevant entities shall respond to incidents in accordance with documented procedures and in a …
------+3.5.2 The incident response procedures shall include the following stages: (a) incident containment, to …
------+3.5.3 The relevant entities shall establish communication plans and procedures: (a) with the Computer …
------+3.5.4 The relevant entities shall log incident response activities in accordance with the procedures …
------+3.5.5 The relevant entities shall test at planned intervals their incident response procedures.
---+3.2.1 and record evidence.
---+3.6 Post-incident reviews
------+3.6.1 Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from …
------+3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their …
------+3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

3. Incident handling

Incident handling

1. Übersicht

3.1 Incident handling policy

Mapping to standards and frameworks

ISO standard 27001:2022A.5 .24
NIST Cybersecurity Framework v2.0GV.SC-08, RS.MA-01, RS.MA-05, RS.MI-01, RS.MI-02, ID.IM-01, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.9.2-12X, REQ-7.9.2-01X, REQ-7.9.2-04X, REQ-7.9.2-05X, REQ-7.9.2-12X, REQ-7.9.2-06X, REQ-7.9.2-08X , REQ-7.9.3-01X through 04X, REQ-7.9.4-01X and 02X
CEN/TS 18026:2024ISP-02, IM-01, IM-07
BE-CyFun®2023BASIC: RS.RP-1.1
IMPORTANT: ID.AM-6.1, PR.IP-9.1, RS.CO-1.1, RS.MI-1.1, RC.RP-1.1
FI-KybermittariRESPONSE-1, RESPONSE-2, RESPONSE-3, RESPONSE-5, CRITICAL-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 24a, 24f
Cybersecurity Handbook: Part B: 17.1
Self-assessment tool: 18.1
ENS-Royal Decree 311/2022Article 12, Article 24, Article 25, Article 33, Article 34,
Technical Security Instruction for Notification of Security Incidents ,
Annex II: [op.exp.7] Incident management, [op.exp.9] Incident management record, [op.mon.1] Intrusion detection, [op.mon.2] Metrics system, [op.mon.3] Monitoring, [op.cont.2] Continuity plan
FR2.C.1-IE/EE
2.C.2-IE/EE
2.C.3-IE/EE
12.1-EE
12.2-EE
12.3-IE/EE
12.4-EE
12.5-EE
12.6-IE/EE
12.7-EE
13.6-EE
13.7-EE
14.1-IE/EE
14.2-IE/EE
14.6-EE
14.8-EE
15.1-IE/EE
15.2-EE
15.3-EE
15.4-EE
3.2 Monitoring and logging

Mapping to standards and frameworks

ISO standard 27001:2022A.5.28, A.8.15, A.8.16, A.8.17
NIST Cybersecurity Framework v2.0RS.AN-06, RS.AN-07, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.9.1-01X, REQ-7.9.1-02X, REQ-7.9.1-03X, REQ-7.9.1-04X, REQ-7.9.1-05X, REQ-7.9.2-11X, REQ-7.10-05, REQ-7.10- 06, REQ-7.10-07, REQ-7.10- 08, REQ-7.10-02
CEN/TS 18026:2024OPS-10, OPS-11, OPS-12, OPS-13, OPS-14, OPS-15, OPS-16, OPS-23, CS-01, IM-07, PSS-01
BE-CyFun®2023BASIC: PR.PT-1.1, DE.AE-3.1
IMPORTANT: PR.AC-2.2, PR.AC-4.5, PR.DS-5.1, PR.IP-7.1, PR.MA-1.3, DE.AE-3.2, DE.CM-1.2, DE.CM-6.1, DE.CM-7.1
ESSENTIAL: ID.SC-3.2, PR.PT-1.3, DE.AE-1.1, DE.AE-3.3, DE.CM-1.3, DE.CM-2.2
FI-KybermittariSITUATION-1, SITUATION-2, SITUATION-3, ASSET-4
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 24c, 24d, 24e
Cybersecurity Handbook: Part B: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8, 8.9, 8.10
Self-assessment tool: 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.10, 9.11
ENS-Royal Decree 311/2022Article 10, Article 21
Annex II: [op.mon.1] Intrusion detection, [op.mon.3] Monitoring, [op.exp.8] Recording of the activity, [op.acc.1] Identification
FR5.B.1-EE
12.6-IE/EE
12.7-EE
13.1-IE/EE
16.3-EE
20.1-EE
20.2-EE
20.3-EE
20.4-EE
20.5-EE
3.3 Event reporting

Mapping to standards and frameworks

ISO standard 27001:2022A.6.8
NIST Cybersecurity Framework v2.0RS.MI-01, RS.CO-02
ETSI Standard EN 319 401 V3.1.1REQ-7.9.2-12X, REQ-7.9.3-01X, REQ-7.9.3-02X
CEN/TS 18026:2024IM-03, IM-04
BE-CyFun®2023BASIC: PR.AT-1.1, DE.CM-3.1
IMPORTANT: PR.AT-1.2, DE.AE-3.2, DE.AE-5.1, DE.CM-2.1, RS.CO-1.1, RS.CO-5.1
ESSENTIAL: DE.AE-1.1, DE.AE-3.3, DE.CM-1.3, RS.CO-2.2
FI-KybermittariRESPONSE-1, WORKFORCE-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 21a.g
Cybersecurity Handbook: Part B: 17.2, 17.7
Self-assessment tool: 18.3
ENS-Royal Decree 311/2022Article 32, Article 33,
Annex II: [op.exp.7] Incident management
FR4.2-IE/EE
4.5-IE/EE
6.2-EE
12.2-EE
14.1-IE/EE
14.2-IE/EE
14.8-EE
3.4 Event assessment and classification

Mapping to standards and frameworks

ISO standard 27001:2022A.5.25
NIST Cybersecurity Framework v2.0DE.AE-04, RS.MA-02, RS.MA-03, RS.MA-04, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.9.3-01X, REQ-7.9.2-11X, REQ-7.9.4-01X, REQ-7.9.4-02X, REQ-7.9.1-05X
CEN/TS 18026:2024IM-02
BE-CyFun®2023BASIC: RS.IM-1.1
IMPORTANT: PR.IP-9.1, DE.AE-1.2, DE.AE-3.2, DE.AE-5.1, DE.DP-3.1, RS.AN-2.1
ESSENTIAL: PR.PT-1.4, DE.AE-2.2, DE.AE-3.3, DE.AE-4.1, DE.CM-1.3, DE.DP-4.1, RS.AN-2.2, RS.AN-3.2
FI-KybermittariRESPONSE-1, RESPONSE-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 24e
Cybersecurity Handbook: Part B: 17.2
Self-assessment tool: 18.2, 18.3
ENS-Royal Decree 311/2022Article 32, Article 33
Technical Security Instruction for Notification of Security Incidents,
Annex II: [op.exp.7] Incident management
FR3.A.1-IE/EE
12.2-EE
12.4-EE
12.5-EE
13.6-EE
14.4-EE
20.2-EE
20.4-EE
3.5 Incident response

Mapping to standards and frameworks

ISO standard 27001:2022A.5.26
NIST Cybersecurity Framework v2.0RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, ID.IM-02, ID.IM-03, ID.IM-04, RS.CO-02, RS.CO-03, RS.AN-03, RS.MI-01, RS.MI-02, RC.CO-03, RC.CO-04.
ETSI Standard EN 319 401 V3.1.1REQ-7.9.2-01X, REQ-7.9-09, REQ-7.9-12, Clause 7.9.2, REQ-7.9.1-05X, REQ-7.9.2-11X, REQ-7.10-01 through 08
CEN/TS 18026:2024OIS-03, IM-01, IM-05, IM-07, INQ-02, INQ-03
BE-CyFun®2023BASIC: RS.RP-1.1
IMPORTANT: PR.IP-9.1
ESSENTIAL: PR.IP-9.2, RS.CO-2.2
FI-KybermittariRESPONSE-2, RESPONSE-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 24a, 24b
Cybersecurity Handbook: Part B: 17.2, 17.3, 17.4, 17.5, 17.6, 17.9, 17.10
Self-assessment tool: 18.2, 18.3, 18.4, 18.5, 18.6, 18.7, 18.8
ENS-Royal Decree 311/2022Article 32, Article 33
Annex II: [op.exp.7] Incident management, [op.cont.3] Periodic tests
FR12.1-EE
12.6-IE/EE
13.6-EE
14.1-IE/EE
14.2-IE/EE
14.3-IE/EE
14.4-EE
14.5-EE
14.6-EE
14.7-EE
14.8-EE
14.9-EE
15.1-IE/EE
15.2-EE
15.3-EE
15.4-EE
3.2.1 and record evidence.

Requirement

and record evidence.

Guidance

  • Log incident response information which contains (indicative, non-exhaustive list):
    • time of detection, containment and eradication;
    • when the systems recovered;
    • indicators of compromise;
    • root cause;
    • actions taken during each phase namely, detection, containment and eradication;
    • assessment of the scope and the level of impact of the incident;
    • communications when responding to the incident;
    • post incident lessons learnt and recommendations; and
    • whether the CSIRT or the competent authority was notified of the incident according to the NIS2 Directive Articles 23 and 30.

Examples of evidence

  • Logs from incident response.
  • Use of a system (e.g. SIEM, EDR/XDR or ticket system).
3.6 Post-incident reviews

Mapping to standards and frameworks

ISO standard 27001:2022A.5.27
NIST Cybersecurity Framework v2.0ID.IM-01, ID.IM-04, RS.AN-08
ETSI Standard EN 319 401 V3.1.1REQ-7.9.5-01X, REQ-7.9.5-03X, REQ-7.9.5-04X,
CEN/TS 18026:2024IM-06
BE-CyFun®2023BASIC: RS.IM-1.1
IMPORTANT: PR.P-7.1, RS.IM-1.2, RS.IM-2.1, RS.CO-1.1, RS.CO-3.2, RC.IM-1.1
FI-KybermittariRESPONSE-3, RESPONSE-5
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 24f
Cybersecurity Handbook: Part B: 17.8
Self-assessment tool: 18.2, 18.3
ENS-Royal Decree 311/2022Article 32, Article 33
Annex II: [op.exp.7] Incident management
FR12.1-EE
12.5-EE
14.1-IE/EE
14.4-EE
15.4-EE
20.2-EE

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is related to 3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)