3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Requirement

The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Guidance

• Conduct an annual review or a review after significant incidents, to determine if an incident has led to a post-incident review.

Examples of evidence

• Documented plans or schedules for future reviews.

Tips: guidance

• Determine the composition of the review team, including members from relevant departments such as IT, security, legal and management bodies.
• Review existing network and information security policies, topic-specific policies relevant to the incident, incident handling procedures and policy and incident response procedures in light of the lessons learnt from post-incident reviews.

Tips: examples of evidence

• Minutes of the post-incident review team.
• Evidence of updates to network and information security or topic-specific policies and procedures based on the lessons learnt from post-incident reviews.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -