ENISA
No hay documentos en este idioma, se muestran los ingleses.
ENISA Secure by Design and Default Playbook
ENISA Technical Advisory for Software Bill of Materials
NIS2 Technical Implementation Guidance
Incidencias
| Título |
Fuente |
|
+ NIS2 Technical Implementation Guidance
|
|
|
---+ Executive summary
|
|
|
---+ Introduction
|
|
|
---+ 1. Policy on the security of network and information systems
|
|
|
------+ 1.1 Policy on the security of network and information systems
|
|
|
---------+ 1.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security …
|
|
|
---------+ 1.1.2 The network and information system security policy shall be reviewed and, where appropriate …
|
|
|
------+ 1.2 Roles, responsibilities and authorities
|
|
|
---------+ 1.2.1 As part of their policy on the security of network and information systems referred to in point …
|
|
|
---------+ 1.2.2 The relevant entities shall require all personnel and third parties to apply network and …
|
|
|
---------+ 1.2.3 At least one person shall report directly to the management bodies on matters of network and …
|
|
|
---------+ 1.2.4 Depending on the size of the relevant entities, network and information system security shall be …
|
|
|
---------+ 1.2.5 Conflicting duties and conflicting areas of responsibility shall be segregated, where applicable.
|
|
|
---------+ 1.2.6 Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by …
|
|
|
---+ 2. Risk management policy
|
|
|
------+ 2.1 Risk management framework
|
|
|
---------+ 2.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 2.1.2 For the purpose of point 2.1.1, the relevant entities shall establish procedures for …
|
|
|
---------+ 2.1.3 When identifying and prioritising appropriate risk treatment options and measures, the relevant …
|
|
|
---------+ 2.1.4 The relevant entities shall review and, where appropriate, update the risk assessment results and …
|
|
|
------+ 2.2 Compliance monitoring
|
|
|
---------+ 2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …
|
|
|
---------+ 2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …
|
|
|
---------+ 2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …
|
|
|
------+ 2.3 Independent review of information and network security
|
|
|
---------+ 2.3.1 The relevant entities shall review independently their approach to managing network and information …
|
|
|
---------+ 2.3.2 The relevant entities shall develop and maintain processes to conduct independent reviews which …
|
|
|
---------+ 2.3.3 The results of the independent reviews, including the results from the compliance monitoring …
|
|
|
---------+ 2.3.4 The independent reviews shall take place at planned intervals and when significant incidents or …
|
|
|
------+ 2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …
|
|
|
---+ 3. Incident handling
|
|
|
------+ 3.1 Incident handling policy
|
|
|
---------+ 3.1.1 For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 3.1.2 The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster …
|
|
|
---------+ 3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed …
|
|
|
------+ 3.2 Monitoring and logging
|
|
|
---------+ 3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on …
|
|
|
---------+ 3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in …
|
|
|
---------+ 3.2.3 Based on the procedures referred to in point 3.2.1., the relevant entities shall maintain, document …
|
|
|
---------+ 3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the …
|
|
|
---------+ 3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect …
|
|
|
---------+ 3.2.6 To the extent feasible, the relevant entities shall ensure that all systems have synchronised time …
|
|
|
---------+ 3.2.7 The procedures as well as the list of assets that are being logged shall be reviewed and, where …
|
|
|
------+ 3.3 Event reporting
|
|
|
---------+ 3.3.1 The relevant entities shall put in place a simple mechanism allowing their employees, suppliers and …
|
|
|
---------+ 3.3.2 The relevant entities shall, where appropriate, communicate the event reporting mechanism to their …
|
|
|
------+ 3.4 Event assessment and classification
|
|
|
---------+ 3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents …
|
|
|
---------+ 3.4.2 For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) carry …
|
|
|
------+ 3.5 Incident response
|
|
|
---------+ 3.5.1 The relevant entities shall respond to incidents in accordance with documented procedures and in a …
|
|
|
---------+ 3.5.2 The incident response procedures shall include the following stages: (a) incident containment, to …
|
|
|
---------+ 3.5.3 The relevant entities shall establish communication plans and procedures: (a) with the Computer …
|
|
|
---------+ 3.5.4 The relevant entities shall log incident response activities in accordance with the procedures …
|
|
|
---------+ 3.5.5 The relevant entities shall test at planned intervals their incident response procedures.
|
|
|
------+ 3.2.1 and record evidence.
|
|
|
------+ 3.6 Post-incident reviews
|
|
|
---------+ 3.6.1 Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from …
|
|
|
---------+ 3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their …
|
|
|
---------+ 3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.
|
|
|
---+ 4. Business continuity and crisis management
|
|
|
------+ 4.1 Business continuity and disaster recovery plan
|
|
|
---------+ 4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 4.1.2 The relevant entities’ operations shall be restored according to the business continuity and …
|
|
|
---------+ 4.1.3 The relevant entities shall carry out a business impact analysis to assess the potential impact of …
|
|
|
---------+ 4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …
|
|
|
------+ 4.2 Backup and redundancy management
|
|
|
---------+ 4.2.1 The relevant entities shall maintain backup copies of data and provide sufficient available …
|
|
|
---------+ 4.2.2 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
|
|
|
---------+ 4.2.3 The relevant entities shall perform regular integrity checks on the backup copies.
|
|
|
---------+ 4.2.4 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
|
|
|
---------+ 4.2.5 Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources …
|
|
|
---------+ 4.2.6 The relevant entities shall carry out regular testing of the recovery of backup copies and …
|
|
|
------+ 4.3 Crisis management
|
|
|
---------+ 4.3.1 The relevant entities shall put in place a process for crisis management.
|
|
|
---------+ 4.3.2 The relevant entities shall ensure that the crisis management process addresses at least the …
|
|
|
---------+ 4.3.3 The relevant entities shall implement a process for managing and making use of information received …
|
|
|
---------+ 4.3.4 The relevant entities shall test, review and, where appropriate, update the crisis management plan …
|
|
|
---+ 5. Supply chain security
|
|
|
------+ 5.1 Supply chain security policy
|
|
|
---------+ 5.1.1 For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 5.1.2 As part of the supply chain security policy referred to in point 5.1.1, the relevant entities shall …
|
|
|
---------+ 5.1.3 When establishing their supply chain security policy, relevant entities shall take into account the …
|
|
|
---------+ 5.1.4 Based on the supply chain security policy and taking into account the results of the risk …
|
|
|
---------+ 5.1.5 The relevant entities shall take into account the elements referred to in point 5.1.2 and 5.1.3. as …
|
|
|
---------+ 5.1.6 The relevant entities shall review the supply chain security policy and monitor, evaluate and …
|
|
|
---------+ 5.1.7 For the purpose of point 5.1.6., the relevant entities shall: (a) regularly monitor reports on the …
|
|
|
------+ 5.2 Directory of suppliers and service providers
|
|
|
---+ 6. Security in network and information systems acquisition, development and maintenance
|
|
|
------+ 6.1 Security in acquisition of ICT services or ICT products
|
|
|
---------+ 6.1.1 For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 6.1.2 For the purpose of point 6.1.1., the processes referred to in point 6.1.1. shall include: (a) …
|
|
|
---------+ 6.1.3 The relevant entities shall review and, where appropriate, update the processes at planned …
|
|
|
------+ 6.2 Secure development life cycle
|
|
|
---------+ 6.2.1 Before developing a network and information system, including software, the relevant entities shall …
|
|
|
---------+ 6.2.2 For the purpose of point 6.2.1., the relevant entities shall: (a) carry out an analysis of security …
|
|
|
---------+ 6.2.3 For outsourced development of network and information systems, the relevant entities shall also …
|
|
|
---------+ 6.2.4 The relevant entities shall review and, where necessary, update their secure development rules at …
|
|
|
------+ 6.3 Configuration management
|
|
|
---------+ 6.3.1 The relevant entities shall take the appropriate measures to establish, document, implement and …
|
|
|
---------+ 6.3.2 For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in …
|
|
|
---------+ 6.3.3 The relevant entities shall review and, where appropriate, update configurations at planned …
|
|
|
------+ 6.4 Change management, repairs and maintenance
|
|
|
---------+ 6.4.1 The relevant entities shall apply change management procedures to control changes of network and …
|
|
|
---------+ 6.4.2 The procedures referred to in point 6.4.1. shall be applied for releases, modifications and …
|
|
|
---------+ 6.4.3 In the event that the regular change management procedures could not be followed due to an …
|
|
|
---------+ 6.4.4 The relevant entities shall review and, where appropriate, update the procedures at planned …
|
|
|
------+ 6.5 Security testing
|
|
|
---------+ 6.5.1 The relevant entities shall establish, implement and apply a policy and procedures for security …
|
|
|
---------+ 6.5.2 The relevant entities shall: (a) establish, based on the risk assessment carried out pursuant to …
|
|
|
---------+ 6.5.3 The relevant entities shall review and, where appropriate, update their security testing policies …
|
|
|
------+ 6.6 Security patch management
|
|
|
---------+ 6.6.1 The relevant entities shall specify and apply procedures, coherent with the change management …
|
|
|
---------+ 6.6.2 By way of derogation from point 6.6.1.(a), the relevant entities may choose not to apply security …
|
|
|
------+ 6.7 Network security
|
|
|
---------+ 6.7.1 The relevant entities shall take the appropriate measures to protect their network and information …
|
|
|
---------+ 6.7.2 For the purpose of point 6.7.1., the relevant entities shall: (a) document the architecture of the …
|
|
|
---------+ 6.7.3 The relevant entities shall review and, where appropriate, update these measures at planned …
|
|
|
------+ 6.8 Network segmentation
|
|
|
---------+ 6.8.1 The relevant entities shall segment systems into networks or zones in accordance with the results …
|
|
|
---------+ 6.8.2 For that purpose, the relevant entities shall: (a) consider the functional, logical and physical …
|
|
|
---------+ 6.8.3 The relevant entities shall review and, where appropriate, update network segmentation at planned …
|
|
|
------+ 6.9 Protection against malicious and unauthorised software
|
|
|
---------+ 6.9.1 The relevant entities shall protect their network and information systems against malicious and …
|
|
|
---------+ 6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or …
|
|
|
------+ 6.10 Vulnerability handling and disclosure
|
|
|
---------+ 6.10.1 The relevant entities shall obtain information about technical vulnerabilities in their network and …
|
|
|
---------+ 6.10.2 For the purpose of point 6.10.1., the relevant entities shall: (a) monitor information about …
|
|
|
---------+ 6.10.3 When justified by the potential impact of the vulnerability, the relevant entities shall create and …
|
|
|
---------+ 6.10.4 The relevant entities shall review and, where appropriate, update at planned intervals the channels …
|
|
|
---+ 7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
|
|
|
------+ 7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
------+ 7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk …
|
|
|
------+ 7.3 The relevant entities shall review and, where appropriate, update the policy and procedures at …
|
|
|
---+ 8. Basic cyber hygiene practices and security training
|
|
|
------+ 8.1 Awareness raising and basic cyber hygiene practices
|
|
|
---------+ 8.1.1 For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 8.1.2 For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including …
|
|
|
---------+ 8.1.3 The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The …
|
|
|
------+ 8.2 Security training
|
|
|
---------+ 8.2.1 The relevant entities shall identify employees, whose roles require security relevant skill sets …
|
|
|
---------+ 8.2.2 The relevant entities shall establish, implement and apply a training program in line with the …
|
|
|
---------+ 8.2.3 The training referred to in point 8.2.1. shall be relevant to the job function of the employee and …
|
|
|
---------+ 8.2.4 The relevant entities shall apply training to staff members who transfer to new positions or roles …
|
|
|
---------+ 8.2.5 The program shall be updated and run periodically taking into account applicable policies and …
|
|
|
---+ 9. Cryptography
|
|
|
------+ 9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
------+ 9.2 The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the …
|
|
|
------+ 9.3 The relevant entities shall review and, where appropriate, update their policy and procedures at …
|
|
|
---+ 10. Human resources security
|
|
|
------+ 10.1 Human resources security
|
|
|
---------+ 10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …
|
|
|
---------+ 10.1.3 The relevant entities shall review the assignment of personnel to specific roles as referred to in …
|
|
|
------+ 10.2 Verification of background
|
|
|
---------+ 10.2.1 The relevant entities shall ensure to the extent feasible verification of the background of their …
|
|
|
---------+ 10.2.2 For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set …
|
|
|
---------+ 10.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 10.3 Termination or change of employment procedures
|
|
|
---------+ 10.3.1 The relevant entities shall ensure that network and information system security responsibilities …
|
|
|
---------+ 10.3.2 For the purpose of point 10.3.1., the relevant entities shall include in the individual’s terms and …
|
|
|
------+ 10.4 Disciplinary process
|
|
|
---------+ 10.4.1 The relevant entities shall establish, communicate and maintain a disciplinary process for handling …
|
|
|
---------+ 10.4.2 The relevant entities shall review and, where appropriate, update the disciplinary process at …
|
|
|
---+ 11. Access control
|
|
|
------+ 11.1 Access control policy
|
|
|
---------+ 11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 11.1.2 The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff …
|
|
|
---------+ 11.1.3 The relevant entities shall review and, where appropriate, update the policies at planned intervals …
|
|
|
------+ 11.2 Management of access rights
|
|
|
---------+ 11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and …
|
|
|
---------+ 11.2.2 The relevant entities shall: (a) assign and revoke access rights based on the principles of …
|
|
|
---------+ 11.2.3 The relevant entities shall review access rights at planned intervals and shall modify them based …
|
|
|
------+ 11.3 Privileged accounts and system administration accounts
|
|
|
---------+ 11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …
|
|
|
---------+ 11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …
|
|
|
---------+ 11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …
|
|
|
------+ 11.4 Administration systems
|
|
|
---------+ 11.4.1 The relevant entities shall restrict and control the use of system administration systems in …
|
|
|
---------+ 11.4.2 For that purpose, the relevant entities shall: (a) only use system administration systems for …
|
|
|
------+ 11.5 Identification
|
|
|
---------+ 11.5.1 The relevant entities shall manage the full life cycle of identities of network and information …
|
|
|
---------+ 11.5.2 For that purpose, the relevant entities shall: (a) set up unique identities for network and …
|
|
|
---------+ 11.5.3 The relevant entities shall only permit identities assigned to multiple persons, such as shared …
|
|
|
---------+ 11.5.4 The relevant entities shall regularly review the identities for network and information systems and …
|
|
|
------+ 11.6 Authentication
|
|
|
---------+ 11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on …
|
|
|
---------+ 11.6.2 For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …
|
|
|
---------+ 11.6.3 The relevant entities shall to the extent feasible use state-of-the-art authentication methods, in …
|
|
|
---------+ 11.6.4 The relevant entities shall regularly review the authentication procedures and technologies at …
|
|
|
------+ 11.7 Multi-factor authentication
|
|
|
---------+ 11.7.1 The relevant entities shall ensure that users are authenticated by multiple authentication factors …
|
|
|
---------+ 11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the …
|
|
|
---+ 12. Asset management
|
|
|
------+ 12.1 Asset classification
|
|
|
---------+ 12.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 12.1.2 For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a system of …
|
|
|
---------+ 12.1.3 The relevant entities shall conduct periodic reviews of the classification levels of assets and …
|
|
|
------+ 12.2 Handling of assets
|
|
|
---------+ 12.2.1 The relevant entities shall establish, implement and apply a policy for the proper handling of …
|
|
|
---------+ 12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …
|
|
|
---------+ 12.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 12.3 Removable media policy
|
|
|
---------+ 12.3.1 The relevant entities shall establish, implement and apply a policy on the management of removable …
|
|
|
---------+ 12.3.2 The policy shall: (a) provide for a technical prohibition of the connection of removable media …
|
|
|
---------+ 12.3.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 12.4 Asset inventory
|
|
|
---------+ 12.4.1 The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent …
|
|
|
---------+ 12.4.2 The granularity of the inventory of the assets shall be at a level appropriate for the needs of the …
|
|
|
---------+ 12.4.3 The relevant entities shall regularly review and update the inventory and their assets and document …
|
|
|
------+ 12.5 Deposit, return or deletion of assets upon termination of employment
|
|
|
---+ 13. Environmental and physical security
|
|
|
------+ 13.1 Supporting utilities
|
|
|
---------+ 13.1.1 For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.1.2 For that purpose, the relevant entities shall, where appropriate: (a) protect facilities from power …
|
|
|
---------+ 13.1.3 The relevant entities shall test, review and, where appropriate, update the protection measures on …
|
|
|
------+ 13.2 Protection against physical and environmental threats
|
|
|
---------+ 13.2.1 For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.2.2 For that purpose, the relevant entities shall, where appropriate: (a) design and implement …
|
|
|
---------+ 13.2.3 The relevant entities shall test, review and, where appropriate, update the protection measures …
|
|
|
------+ 13.3 Perimeter and physical access control
|
|
|
---------+ 13.3.1 For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.3.2 For that purpose, the relevant entities shall: (a) on the basis of the risk assessment carried out …
|
|
|
---------+ 13.3.3 The relevant entities shall test, review and, where appropriate, update the physical access control …
|
|
|
---+ Annex I national frameworks
|
|
|
---+ Annex II glossary
|
|
Technical Competence Requirements for CRA Notified Bodies
Incidencias
| Título |
Fuente |
|
+ Technical Competence Requirements for CRA Notified Bodies
|
|
|
---+ 1. Introduction
|
|
|
------+ 1.1 Background
|
|
|
------+ 1.2 Scope
|
|
|
------+ 1.3 Relevant conformity assessment standards
|
|
|
---+ 2. Basic Concepts
|
|
|
------+ 2.1 Regulation
|
|
|
------+ 2.2 Roles
|
|
|
------+ 2.3 Competences, knowledge and skills
|
|
|
---+ 3. Required Knowledge and Skills
|
|
|
------+ 3.1 Overview
|
|
|
------+ 3.2 Competences for performing evaluations
|
|
|
---------+ 3.2.1 Knowledge of common industry practices
|
|
|
---------+ 3.2.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.2.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.2.4 Evaluation skills
|
|
|
---------+ 3.2.5 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.2.6 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.2.7 Knowledge of client’s business sector
|
|
|
---------+ 3.2.8 Knowledge of client products, processes and organisation
|
|
|
---------+ 3.2.9 Evaluation management skills
|
|
|
------+ 3.3 Competences for preparing evaluations
|
|
|
---------+ 3.3.1 Knowledge of common industry practices
|
|
|
---------+ 3.3.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.3.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.3.4 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.3.5 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.3.6 Knowledge of client’s business sector
|
|
|
---------+ 3.3.7 Knowledge of client products, processes and organisation
|
|
|
------+ 3.4 Competences for reviewing reports and making decisions
|
|
|
---------+ 3.4.1 Knowledge of common industry practices
|
|
|
---------+ 3.4.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.4.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.4.4 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.4.5 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.4.6 Knowledge of client’s business sector
|
|
|
---------+ 3.4.7 Knowledge of client’s products, processes and organisations
|
|
|
---+ 4. Competence requirements
|
|
|
------+ 4.1 Parameters
|
|
|
------+ 4.2 Input from EA’s Accreditation for Notification (AfN) Project
|
|
|
------+ 4.3 Management of competences
|
|