+2.2 Compliance monitoring
---+2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …
---+2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …
---+2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …

2.2 Compliance monitoring

Mapping to standards and frameworks

ISO standard 27001:20229.2, A.5.31, A.5.35, A.5.36
NIST Cybersecurity Framework v2.0GV.OV-02, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 7.13, REQ-6.3-06X , REQ-6.3-07X, REQ-6.1-08
CEN/TS 18026:2024CO-01, DOC-03, INQ-01, INQ-02, INQ-03
BE-CyFun®2023BASIC: RS.IM-1.1
IMPORTANT: ID.GV-1.2, ID.GV-3.2, ID.SC-4.1, PR.AT-3.3, PR.IP-9.1, DE.DP-3.1, DE.DP-5.1, RS.IM-1.2, RC.IM-1.1
ESSENTIAL: ID.SC-4.2, PR.AT-3.4, PR.IP-7.2, PR.IP-9.2, DE.DP-5.2
FI-KybermittariPROGRAM-1, PROGRAM-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 9a, 9b, 9c
Cybersecurity Handbook: Part A: 2
Self assessment tool: 1.11, 1.12, 1.19, 1.20
ENS-Royal Decree 311/2022Article 10, Article 28, Article 31, Article 32
Technical Security Instruction on Safety Status Report.
Technical Security Instruction on Information Systems Security Auditing
ANNEX III - Security audit
FR2.A.1-IE/EE
2.B.2-IE/EE
2.B.4-IE/EE
2.C.1-IE/EE
2.C.2-IE/EE
2.C.3-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE

1. Overview

2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …

Requirement

The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.

Guidance

  • Develop a standardized report format for reporting to management bodies. Consider the following elements (indicative, non-exhaustive list):
    • key metrics,
    • compliance status, including policy exceptions,
    • identified risks and
    • recommended actions.
  • Reports are generated and presented to management bodies at least annually.

Examples of evidence

  • Recent compliance review reports.
  • Logs of policy exceptions. Examples of such exceptions include, among others, the situations mentioned in the second paragraph of Article 2(2) and those under recital 5 of the regulation. Other examples include (indicative, non-exhaustive list):
    • software updates: if a system relies on an older version of software that is incompatible with the latest update, an exception might be granted to delay the update until a compatible solution is found;
    • access control: if a particular user or system cannot support an authentication mechanism (e.g. multi-factor authentication (MFA)) due to technical limitations, an exception might be granted while alternative measures are implemented; and
    • encryption: if a legacy system does not support encryption, an exception might be granted until the system is replaced.
  • Records of the exception request and approval, along with details of the compensatory controls implemented.
2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …

Requirement

The relevant entities shall put in place an effective compliance reporting system which shall be appropriate to their structures, operating environments and threat landscapes. The compliance reporting system shall be capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks.

Guidance

  • Set up procedures for compliance monitoring, including (indicative, non-exhaustive list):
    • objectives and a high-level approach to compliance monitoring;
    • relevant security policies that are subject to compliance monitoring;
    • the frequency of compliance reviews;
    • who should carry out compliance reviews (internal or external); and
    • templates for compliance review reports.
  • Analyse and evaluate the results of the compliance review.

Examples of evidence

  • Documented procedures for monitoring compliance.
  • Documented analysis and evaluation of the results, including the current state of the entity’s risk management.
  • Detailed compliance monitoring plans, including long-term, high-level objectives and planning.
2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …

Requirement

The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

  • Compliance monitoring should take place at least annually, taking into account:
    • significant incidents, if any;
    • changes to the environment of operation;
    • changes to the threat landscape and cybersecurity legal and regulatory requirements;
    • changes to standards; and
    • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

  • Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
  • Evidence that reports of lessons learned or root cause analysis of past incidents, if any, were taken into account.

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is related to 2.2. Compliance monitoring