+6. Security in network and information systems acquisition, development and maintenance (Article …
---+6.1. Security in acquisition of ICT services or ICT products
------+6.1.1. For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant …
------+6.1.2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include: (a) …
------+6.1.3. The relevant entities shall review and, where appropriate, update the processes at planned …
---+6.2. Secure development life cycle
------+6.2.1. Before developing a network and information system, including software, the relevant …
------+6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
------+6.2.3. For outsourced development of network and information systems, the relevant entities shall …
------+6.2.4. The relevant entities shall review and, where necessary, update their secure development …
---+6.3. Configuration management
------+6.3.1. The relevant entities shall take the appropriate measures to establish, document, implement …
------+6.3.2. For the purpose of point 6.3.1, the relevant entities shall: (a) lay down and ensure …
------+6.3.3. The relevant entities shall review and, where appropriate, update configurations at planned …
---+6.4. Change management, repairs and maintenance
------+6.4.1. The relevant entities shall apply change management procedures to control changes of network …
------+6.4.2. The procedures referred to in point 6.4.1 shall be applied for releases, modifications and …
------+6.4.3. In the event that the regular change management procedures could not be followed due to an …
------+6.4.4. The relevant entities shall review and, where appropriate, update the procedures at planned …
---+6.5. Security testing
------+6.5.1. The relevant entities shall establish, implement and apply a policy and procedures for …
------+6.5.2. The relevant entities shall: (a) establish, based on the risk assessment carried out …
------+6.5.3. The relevant entities shall review and, where appropriate, update their security testing …
---+6.6. Security patch management
------+6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
------+6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
---+6.7. Network security
------+6.7.1. The relevant entities shall take the appropriate measures to protect their network and …
------+6.7.2. For the purpose of point 6.7.1, the relevant entities shall: (a) document the architecture …
------+6.7.3. The relevant entities shall review and, where appropriate, update these measures at planned …
---+6.8. Network segmentation
------+6.8.1. The relevant entities shall segment systems into networks or zones in accordance with the …
------+6.8.2. For that purpose, the relevant entities shall: (a) consider the functional, logical and …
------+6.8.3. The relevant entities shall review and, where appropriate, update network segmentation at …
---+6.9. Protection against malicious and unauthorised software
------+6.9.1. The relevant entities shall protect their network and information systems against malicious …
------+6.9.2. For that purpose, the relevant entities shall in particular implement measures that detect …
---+6.10. Vulnerability handling and disclosure
------+6.10.1. The relevant entities shall obtain information about technical vulnerabilities in their …
------+6.10.2. For the purpose of point 6.10.1, the relevant entities shall: (a) monitor information about …
------+6.10.3. When justified by the potential impact of the vulnerability, the relevant entities shall …
------+6.10.4. The relevant entities shall review and, where appropriate, update at planned intervals the …
|
6. Security in network and information systems acquisition, development and maintenance (Article …
6. Security in network and information systems acquisition, development and maintenance (Article 21(2), point (e), of Directive (EU) 2022/2555)
1. Ülevaade
1.1 Viited
1.2 Tuvastatud nõuded
1.3 Seotud standardid
2. Tuvastatud nõuded
3. Seotud standardid
Lingitud teemad
|