1.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security …

Requirement

For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall: (a) set out the relevant entities’ approach to managing the security of their network and information systems; (b) be appropriate to and complementary with the relevant entities’ business strategy and objectives; (c) set out network and information security objectives; (d) include a commitment to continual improvement of the security of network and information systems; (e) include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies; (f) be communicated to and acknowledged by relevant employees and relevant interested external parties; (g) lay down roles and responsibilities pursuant to point 1.2; (h) list the documentation to be kept and the duration of retention of the documentation; (i) list the topic-specific policies; (j) lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security; (k) indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).

Guidance

• Set a policy on the security of network and information systems, covering all systems, assets and procedures that fall within the scope of the policy.
• Make sure that relevant personnel and relevant interested external parties, acknowledge the policy on the security of network and information systems, typically through a signed document or digital acknowledgement, where applicable.
  • Depending on the context, external parties may mean suppliers, service providers, shareholders, authorities, visitors, external interest groups or forums.
  • The acknowledgement may be included in other contracts, such as employment contracts or service provision contracts.
  • The policy should be communicated to relevant personnel and interested external parties in a form that is relevant, accessible and understandable to the intended reader.
  • Relevant personnel and relevant interested external parties may not be made aware of the full text of the policy. Depending on their role, an extract or a summary containing only relevant information should be communicated and acknowledged. If the policy is distributed outside the entity, care should be taken not to disclose confidential information.
  • For contractual requirements of direct suppliers and service providers, point 5.1.4 of the Annex to the regulation.
• Make sure that personnel are aware of their responsibilities for the security of network and information systems.
• Make sure that the policy on the security of network and information systems is approved by the management bodies.
• Make sure that the topic-specific policies are approved by an appropriate level of management.
• Make sure that the policy includes detailed guidance on the procedures for managing policy exceptions.

Examples of evidence

• Documented policy on the security of network and information systems which contains the elements required by points 1.1.1 (a) to 1.1.1 (k) of the Annex to the regulation.
• The date of the formal approval by the management bodies of the relevant entities, indicated in the policy on the security of network and information systems.
• Where applicable, acknowledgement forms or employment contracts, signed by personnel, which confirm they have read and understood the security policies.
• Where applicable, acknowledgement forms, service provision contracts or other contracts, signed by relevant interested external parties, which confirm they have read and understood the security policies.
• Evidence that the management bodies understand their role, responsibilities and authorities regarding network and information security. This can include but is not limited to:
  • allocation of resources for policy implementation;
  • requests (e.g. announcements, emails and documents) to personnel to apply network and information security in accordance with the established policies and procedures; and
  • any initiatives that indicate that management bodies promote improvement in the area of network and information security.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• ENISA -