ID.IM-01 Improvements are identified from evaluations

Statement

Improvements are identified from evaluations

Guidance

Perform self-assessments of critical services that take current threats and TTPs into consideration

Guidance

Invest in third-party assessments or independent audits of the effectiveness of the organization's cybersecurity program to identify areas that need improvement

Guidance

Constantly evaluate compliance with selected cybersecurity requirements through automated means

1. Overview

1.1 References

• 1.1 Policy on the security of network and information systems
• 1.2 Roles, responsibilities and authorities
• 2.1 Risk management framework
• 2.2 Compliance monitoring
• 2.3 Independent review of information and network security
• 2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …
• 3.1 Incident handling policy
• 3.2 Monitoring and logging
• 3.4 Event assessment and classification
• 3.6 Post-incident reviews
• 5.1 Supply chain security policy
• 5.2 Directory of suppliers and service providers
• 6.1 Security in acquisition of ICT services or ICT products
• 6.2 Secure development life cycle
• 6.3 Configuration management
• 6.4 Change management, repairs and maintenance
• 6.5 Security testing
• 6.6 Security patch management
• 6.7 Network security
• 6.8 Network segmentation
• 6.9 Protection against malicious and unauthorised software
• 6.10 Vulnerability handling and disclosure
• 7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
• 8.1 Awareness raising and basic cyber hygiene practices
• 8.2 Security training
• 9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
• 10.1 Human resources security
• 10.2 Verification of background
• 10.4 Disciplinary process
• 11.1 Access control policy
• 11.2 Management of access rights
• 11.3 Privileged accounts and system administration accounts
• 11.6 Authentication
• 12.2 Handling of assets
• 12.3 Removable media policy
• 12.4 Asset inventory
• 13.1 Supporting utilities
• 13.2 Protection against physical and environmental threats

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final