+2. Risk management policy
---+2.1 Risk management framework
------+2.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities …
------+2.1.2 For the purpose of point 2.1.1, the relevant entities shall establish procedures for …
------+2.1.3 When identifying and prioritising appropriate risk treatment options and measures, the relevant …
------+2.1.4 The relevant entities shall review and, where appropriate, update the risk assessment results and …
---+2.2 Compliance monitoring
------+2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …
------+2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …
------+2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …
---+2.3 Independent review of information and network security
------+2.3.1 The relevant entities shall review independently their approach to managing network and information …
------+2.3.2 The relevant entities shall develop and maintain processes to conduct independent reviews which …
------+2.3.3 The results of the independent reviews, including the results from the compliance monitoring …
------+2.3.4 The independent reviews shall take place at planned intervals and when significant incidents or …
---+2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …

2. Risk management policy

Risk management policy

1. Resumen

2.1 Risk management framework

Mapping to standards and frameworks

ISO standard 27001:20226.1, 6.1.2, 6.1.3, 6.2, 8.2, 8.3, A5.7, Α.5.19, Α.5.20, Α.5.21
NIST Cybersecurity Framework v2.0ID.RA-01, ID.RA-02, ID.RA-03, ID.RA-04, ID.RA-05, ID.RA-06, GV.RM-03, ID.RM-01, GV.RM-06, GV.RR-03, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 5, Clause 6.3
CEN/TS 18026:2024OIS-01, RM-01, RM-02, RM-03
BE-CyFun®2023BASIC: ID.GV-4.1, ID.RA-5.1
IMPORTANT: ID.BE-4.1, ID.GV-4.2, ID.RA-5.2, ID.RA-6.1, ID.RM-1.1, ID.RM-2.1, ID.RM-3.1, ID.SC-2.1, ID.SC-3.1, PR.AC-7.1, DE.CM-6.2, RS.MI-1.1
ESSENTIAL: ID.RA-5.3, ID.SC-1.1, PR.AC-1.5, DE.AE-4.1
FI-KybermittariCRITICAL-2, RISK-1, RISK-2, RISK-3, RISK-4, RISK-5, THIRD-PARTIES-2, WORKFORCE-3, WORKFORCE-4
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 5.1a, 5.1b, 5.1c, 5.1d, 5.2
Cybersecurity Handbook: Part A: 2
Self assessment tool: 1.15, 1.16, 1.17, 1.18, 1.19
ENS-Royal Decree 311/2022Article 7, Article 14,
Annex II: [op.pl.1] Risk analysis, [op.mon.2] Metrics system, [op.ext.3] Protection of the supply chain
FR3.A.IE/EE
16.1-EE
16.2-EE
16.3-EE
16.4-EE
20.2-EE
2.2 Compliance monitoring

Mapping to standards and frameworks

ISO standard 27001:20229.2, A.5.31, A.5.35, A.5.36
NIST Cybersecurity Framework v2.0GV.OV-02, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 7.13, REQ-6.3-06X , REQ-6.3-07X, REQ-6.1-08
CEN/TS 18026:2024CO-01, DOC-03, INQ-01, INQ-02, INQ-03
BE-CyFun®2023BASIC: RS.IM-1.1
IMPORTANT: ID.GV-1.2, ID.GV-3.2, ID.SC-4.1, PR.AT-3.3, PR.IP-9.1, DE.DP-3.1, DE.DP-5.1, RS.IM-1.2, RC.IM-1.1
ESSENTIAL: ID.SC-4.2, PR.AT-3.4, PR.IP-7.2, PR.IP-9.2, DE.DP-5.2
FI-KybermittariPROGRAM-1, PROGRAM-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 9a, 9b, 9c
Cybersecurity Handbook: Part A: 2
Self assessment tool: 1.11, 1.12, 1.19, 1.20
ENS-Royal Decree 311/2022Article 10, Article 28, Article 31, Article 32
Technical Security Instruction on Safety Status Report.
Technical Security Instruction on Information Systems Security Auditing
ANNEX III - Security audit
FR2.A.1-IE/EE
2.B.2-IE/EE
2.B.4-IE/EE
2.C.1-IE/EE
2.C.2-IE/EE
2.C.3-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE
2.3 Independent review of information and network security

Mapping to standards and frameworks

ISO standard 27001:20229.2, 10.1, A.5.35, A.8.34
NIST Cybersecurity Framework v2.0GV.OV-02, ID.IM-01
ETSI Standard EN 319 401 V3.1.1Clause 7.13, REQ-7.2-11X , REQ-7.2-14X (d)
CEN/TS 18026:2024CO-01, CO-02, CO-03, CO-04
BE-CyFun®2023ESSENTIAL: ID.SC-4.2, PR.IP-7.2, DE.DP-5.2, DE.CM-2.2
FI-KybermittariPROGRAM-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 8a, 8b, 8c, 8d
Cybersecurity Handbook:-
Self assessment tool: 15.2
ENS-Royal Decree 311/2022Article 31
ANNEX III - Security audit, National Security Framework Compliance, sections V (National Security Framework Compliance) and VI (Requirements of the certifier bodies)
Technical Security Instruction on Information Systems Security Auditing
Technical Security Instruction for compliance with the National Security Framework
FR3.B.2-EI/EE
17.2-EE
2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …

Requirement

and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.

Guidance

  • Analyse and evaluate the results of the independent review.
  • Report results to management bodies.
  • Use a standardized report format for reporting to the management bodies. Consider the following elements (indicative, non-exhaustive list):
    • executive summary, including the scope and key findings,
    • methodology,
    • detailed findings, including gaps identified and non-compliance issues,
    • recommendations and
    • conclusions.
  • Reports are generated and presented to management bodies at least annually.
  • Take corrective actions or justify, accept and document residual risks.
  • The outcomes of independent reviews should be systematically reflected in the risk assessment results and risk treatment plans (Annex to the regulation, point 2.1). Specifically, when a risk is identified or reassessed through an independent review, the corresponding risk assessment should be updated accordingly. This ensures that the risk profile remains accurate and that any emerging or evolving risks are adequately captured and addressed in the overall risk management framework.

Examples of evidence

  • Documented analysis and evaluation of the results, including any residual risks.
  • Minutes from past reviews.
  • Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
  • Documentation of any corrective actions.
  • Budget approval for any corrective actions.
  • The most recent results of compliance monitoring and auditing.
  • Records from updated risk register.

Mapping to standards and frameworks

ISO standard 27001:20229.2, A.5.31, A.5.35, A.5.36
NIST Cybersecurity Framework v2.0GV.OV-02, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 7.13, REQ-6.3-06X , REQ-6.3-07X, REQ-6.1-08
CEN/TS 18026:2024CO-01, DOC-03, INQ-01, INQ-02, INQ-03
BE-CyFun®2023BASIC: RS.IM-1.1
IMPORTANT: ID.GV-1.2, ID.GV-3.2, ID.SC-4.1, PR.AT-3.3, PR.IP-9.1, DE.DP-3.1, DE.DP-5.1, RS.IM-1.2, RC.IM-1.1
ESSENTIAL: ID.SC-4.2, PR.AT-3.4, PR.IP-7.2, PR.IP-9.2, DE.DP-5.2
FI-KybermittariPROGRAM-1, PROGRAM-2
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 9a, 9b, 9c
Cybersecurity Handbook: Part A: 2
Self assessment tool: 1.11, 1.12, 1.19, 1.20
ENS-Royal Decree 311/2022Article 10, Article 28, Article 31, Article 32
Technical Security Instruction on Safety Status Report.
Technical Security Instruction on Information Systems Security Auditing
ANNEX III - Security audit
FR2.A.1-IE/EE
2.B.2-IE/EE
2.B.4-IE/EE
2.C.1-IE/EE
2.C.2-IE/EE
2.C.3-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones

Incidencias vinculadas

Vínculos
is related to 2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)