2.3.4 The independent reviews shall take place at planned intervals and when significant incidents or …

Requirement

The independent reviews shall take place at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Independent reviews should take place at least annually, taking into account:
  • significant incidents, if any;
  • changes to the environment of operation;
  • changes to the threat landscape and cybersecurity legal and regulatory requirements; and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Independent review reports documenting findings, recommendations and actions taken in response.
• Summaries of previous independent reviews, highlighting the scope and frequency.
• Records of significant incidents that occurred in the past year, along with any corresponding review or analysis documentation.
• Annual independent review plans or schedules that outline the scope of independent reviews and the specific measures being evaluated.

Tips: guidance

• Make sure that the independent review process is approved by management bodies.
• Make sure that the results of the review are approved by management bodies.

Tips: examples of evidence

• Documented procedures approved by management bodies.
• Approval of the residual risks by management bodies.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -