7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken by the relevant entity are effectively implemented and maintained.

Guidance

• Take into account industry-recognised standards when developing the policy and procedures for assessing the efficient implementation of the measures (72).
• Implement a policy for assessing the effectiveness of implementation of measures that is proportionate to the risk posture of the entity in line with the risk assessment.

Examples of evidence

• Documented policy and procedures for effectiveness assessments based on good practices and standards (73).

Mapping to standards and frameworks

1. Ülevaade

1.1 Viited

• ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
• GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
• ID.IM-01 Improvements are identified from evaluations
• ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
• ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

Lingitud teemad

• ENISA -