1.1 Policy on the security of network and information systems

Requirement

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall: (a) set out the relevant entities’ approach to managing the security of their network and information systems; (b) be appropriate to and complementary with the relevant entities’ business strategy and objectives; (c) set out network and information security objectives; (d) include a commitment to continual improvement of the security of network and information systems; (e) include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies; (f) be communicated to and acknowledged by relevant employees and relevant interested external parties; (g) lay down roles and responsibilities pursuant to point 1.2; (h) list the documentation to be kept and the duration of retention of the documentation; (i) list the topic-specific policies; (j) lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security; (k) indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).

Guidance

• Set a policy on the security of network and information systems, covering all systems, assets and procedures that fall within the scope of the policy.
• Make sure that relevant personnel and relevant interested external parties, acknowledge the policy on the security of network and information systems, typically through a signed document or digital acknowledgement, where applicable.
  • Depending on the context, external parties may mean suppliers, service providers, shareholders, authorities, visitors, external interest groups or forums.
  • The acknowledgement may be included in other contracts, such as employment contracts or service provision contracts.
  • The policy should be communicated to relevant personnel and interested external parties in a form that is relevant, accessible and understandable to the intended reader.
  • Relevant personnel and relevant interested external parties may not be made aware of the full text of the policy. Depending on their role, an extract or a summary containing only relevant information should be communicated and acknowledged. If the policy is distributed outside the entity, care should be taken not to disclose confidential information.
  • For contractual requirements of direct suppliers and service providers, point 5.1.4 of the Annex to the regulation.
• Make sure that personnel are aware of their responsibilities for the security of network and information systems.
• Make sure that the policy on the security of network and information systems is approved by the management bodies.
• Make sure that the topic-specific policies are approved by an appropriate level of management.
• Make sure that the policy includes detailed guidance on the procedures for managing policy exceptions.

Examples of evidence

• Documented policy on the security of network and information systems which contains the elements required by points 1.1.1 (a) to 1.1.1 (k) of the Annex to the regulation.
• The date of the formal approval by the management bodies of the relevant entities, indicated in the policy on the security of network and information systems.
• Where applicable, acknowledgement forms or employment contracts, signed by personnel, which confirm they have read and understood the security policies.
• Where applicable, acknowledgement forms, service provision contracts or other contracts, signed by relevant interested external parties, which confirm they have read and understood the security policies.
• Evidence that the management bodies understand their role, responsibilities and authorities regarding network and information security. This can include but is not limited to:
  • allocation of resources for policy implementation;
  • requests (e.g. announcements, emails and documents) to personnel to apply network and information security in accordance with the established policies and procedures; and
  • any initiatives that indicate that management bodies promote improvement in the area of network and information security.

Requirement

The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.

Guidance

• Review the policy on the security of network and information systems at least annually, taking into account (indicative, non-exhaustive list):
  • updates to the risk assessment results and the risk treatment plan (Annex to the regulation, point 2.1.4);
  • relevant changes in legislation (laws, regulations and other measures imposed by national competent authorities);
  • recommendations provided by relevant authorities;
  • relevant changes in industry good practices;
  • feedback from interested parties;
  • findings of compliance monitoring (section 2.2) and of independent reviews (Annex to the regulation, point 2.3), including policy violations or policy exceptions;
  • incidents, even those affecting similar entities in the sector.
• Update the policy on the security of network and information systems and topic-specific policies, in line with new findings that could affect the entity’s approach to managing information security, including (9):
  • updates to the risk assessment results and the risk treatment plan (Annex to the regulation, point 2.1.4);
  • changes to the network and information systems;
  • changes to the environment of operation;
  • problems identified during the implementation of the policy;
  • findings of compliance monitoring (Annex to the regulation, point 2.2.1) and of independent reviews (Annex to the regulation, point 2.3), including policy violations or policy exceptions;
  • the status of preventive and corrective actions;
  • trends related to threats and vulnerabilities; and
  • known reported security incidents.
• All updates to the policy should be based on the covered entity's unique security risks identified through its risk assessment.
• Obtain approval for the revised policy and the policy exceptions by the management bodies.

Examples of evidence

• Review comments or change logs for the policy on the security of network and information systems and topic-specific policies.
• Documentation of the review process of the requirements listed in point 1.1.1 of the Annex to the regulation.
• Up-to-date policy on the security of network and information systems and topic-specific policies.
• Evidence that any updates to the policy on the security of network and information systems and any policy exceptions, are approved by management bodies and a record is kept.
• Evidence that any updates to the topic-specific policies are approved by an appropriate level of management and a record is kept.
• Records of the management review.

Tips: guidance

• Analyse the policy on the security of network and information systems for compliance with:
  • legislative, regulatory and contractual requirements;
  • awareness and training requirements (Annex to the regulation, points 8.1 and 8.2); and
  • business continuity requirements (Annex to the regulation, point 4.1).
• Define procedures to facilitate the implementation of the policy on the security of network and information systems and associated measures.
• Examine documentation of post-incident reviews for significant incidents (10) that include participation and input from management bodies.
• Ensure that the policy is:
  • protected in terms of confidentiality (on a need-to-know basis), integrity, availability and authenticity;
  • managed properly so the information is complete, correct, understandable, easily identifiable and retrievable.

Tips: examples of evidence

• Documented policy on the security of network and information systems, including networks and services in scope, assets supporting them and the security objectives, including applicable laws and regulations, accessible to personnel.
• Documented topic-specific policies, including applicable laws and regulations, accessible to relevant personnel.
• Evidence of cybersecurity training of management, for instance:
  • training records;
  • workshop and seminar attendance; and
  • continuous learning materials.
• Internal communication logs, ad hoc reports or communication policy or records showing regular briefings or updates provided to management bodies regarding cybersecurity matters or during significant incidents.