6.5.2 The relevant entities shall: (a) establish, based on the risk assessment carried out pursuant to …

Requirement

The relevant entities shall: (a) establish, based on the risk assessment carried out pursuant to point 2.1, the need, scope, frequency and type of security tests; (b) carry out security tests according to a documented test methodology, covering the components identified as relevant for secure operation in a risk analysis; (c) document the type, scope, time and results of the tests, including assessment of criticality and mitigating actions for each finding; (d) apply mitigating actions in case of critical findings.

Guidance

• Make sure that network and information systems undergo continuous testing, particularly in environments utilizing continuous integration / continuous deployment practices. Regular testing should be conducted at set-up, after significant upgrades or modifications and following maintenance, to maintain robust security and performance.
• Consider a range of security tests (e.g. vulnerability assessments, penetration testing, code review, ethical hacking, bug bounty programmes, cyber attack simulations, red teaming, protocol conformance testing or cyber response exercises) and select the most appropriate one (or more) to test the specific procedure, service or tool over time.
• Entity-wide scoped tests should be carried out at planned intervals or when significant incidents or changes occur.
• Conduct internal and/or external audits throughout the entity’s networks, systems and processes in an ad-hoc manner.
• Record evidence while testing. The need, scope, frequency, type and results are to be documented in a manner that is comprehensible to an expert third party.
• Use criteria to assess the results of the tests similar to the criteria for performing cybersecurity risk assessments (guidance on point 2.1.2 of the Annex to the regulation).
• Assess, follow up and remediate high-criticality findings with respect to the confidentiality, integrity, authenticity or availability of the service provided.
• Document the assessment of criticality and mitigating actions for each finding. Ensure that risk assessment results and risk treatment plans are updated accordingly (Annex to the regulation, point 2.1).
• When testing reveals an underlying security issue in a free and open source component, these findings must be shared with the relevant open source project. If a patch is developed to address the issue, the relevant code should also be shared with the relevant open source project, in a manner suitable for integration.
• Where appropriate, any automated security tests written by entities for open source components that they use, should be shared with the relevant open source projects.

Examples of evidence

• Documented security testing policy and procedures that include the elements referred to in point 5.2 (a) of the Annex to the regulation.
• Documentation defining the roles and responsibilities of personnel involved in security testing.
• Plans or schedules for upcoming or completed regular or ad hoc tests.
• List of reports from past security tests This should cover various types of testing (e.g. vulnerability assessments, penetration testing and code reviews).
• Internal or external audit reports.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -