+6. Security in network and information systems acquisition, development and maintenance (Article …
---+6.1. Security in acquisition of ICT services or ICT products
------+6.1.1. For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant …
------+6.1.2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include: (a) …
------+6.1.3. The relevant entities shall review and, where appropriate, update the processes at planned …
---+6.2. Secure development life cycle
------+6.2.1. Before developing a network and information system, including software, the relevant …
------+6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
------+6.2.3. For outsourced development of network and information systems, the relevant entities shall …
------+6.2.4. The relevant entities shall review and, where necessary, update their secure development …
---+6.3. Configuration management
------+6.3.1. The relevant entities shall take the appropriate measures to establish, document, implement …
------+6.3.2. For the purpose of point 6.3.1, the relevant entities shall: (a) lay down and ensure …
------+6.3.3. The relevant entities shall review and, where appropriate, update configurations at planned …
---+6.4. Change management, repairs and maintenance
------+6.4.1. The relevant entities shall apply change management procedures to control changes of network …
------+6.4.2. The procedures referred to in point 6.4.1 shall be applied for releases, modifications and …
------+6.4.3. In the event that the regular change management procedures could not be followed due to an …
------+6.4.4. The relevant entities shall review and, where appropriate, update the procedures at planned …
---+6.5. Security testing
------+6.5.1. The relevant entities shall establish, implement and apply a policy and procedures for …
------+6.5.2. The relevant entities shall: (a) establish, based on the risk assessment carried out …
------+6.5.3. The relevant entities shall review and, where appropriate, update their security testing …
---+6.6. Security patch management
------+6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
------+6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
---+6.7. Network security
------+6.7.1. The relevant entities shall take the appropriate measures to protect their network and …
------+6.7.2. For the purpose of point 6.7.1, the relevant entities shall: (a) document the architecture …
------+6.7.3. The relevant entities shall review and, where appropriate, update these measures at planned …
---+6.8. Network segmentation
------+6.8.1. The relevant entities shall segment systems into networks or zones in accordance with the …
------+6.8.2. For that purpose, the relevant entities shall: (a) consider the functional, logical and …
------+6.8.3. The relevant entities shall review and, where appropriate, update network segmentation at …
---+6.9. Protection against malicious and unauthorised software
------+6.9.1. The relevant entities shall protect their network and information systems against malicious …
------+6.9.2. For that purpose, the relevant entities shall in particular implement measures that detect …
---+6.10. Vulnerability handling and disclosure
------+6.10.1. The relevant entities shall obtain information about technical vulnerabilities in their …
------+6.10.2. For the purpose of point 6.10.1, the relevant entities shall: (a) monitor information about …
------+6.10.3. When justified by the potential impact of the vulnerability, the relevant entities shall …
------+6.10.4. The relevant entities shall review and, where appropriate, update at planned intervals the …

6. Security in network and information systems acquisition, development and maintenance (Article …

6.   Security in network and information systems acquisition, development and maintenance (Article 21(2), point (e), of Directive (EU) 2022/2555)

1. Resumen

,
6.1. Security in acquisition of ICT services or ICT products

6.1.   Security in acquisition of ICT services or ICT products

6.2. Secure development life cycle

6.2.   Secure development life cycle

6.3. Configuration management

6.3.   Configuration management

6.4. Change management, repairs and maintenance

6.4.   Change management, repairs and maintenance

6.5. Security testing

6.5.   Security testing

6.6. Security patch management

6.6.   Security patch management

6.7. Network security

6.7.   Network security

6.8. Network segmentation

6.8.   Network segmentation

6.9. Protection against malicious and unauthorised software

6.9.   Protection against malicious and unauthorised software

6.10. Vulnerability handling and disclosure

6.10.   Vulnerability handling and disclosure

1.1 Referencias

1.2 Requisitos identificados

1.3 Estándares relacionados

2. Requisitos identificados

Requisitos

3. Estándares relacionados

Estándares

Incidencias vinculadas

Vínculos
is related to 6. Security in network and information systems acquisition, development and maintenance