2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …

Requirement

The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.

Guidance

• Develop a standardized report format for reporting to management bodies. Consider the following elements (indicative, non-exhaustive list):
  • key metrics,
  • compliance status, including policy exceptions,
  • identified risks and
  • recommended actions.
• Reports are generated and presented to management bodies at least annually.

Examples of evidence

• Recent compliance review reports.
• Logs of policy exceptions. Examples of such exceptions include, among others, the situations mentioned in the second paragraph of Article 2(2) and those under recital 5 of the regulation. Other examples include (indicative, non-exhaustive list):
  • software updates: if a system relies on an older version of software that is incompatible with the latest update, an exception might be granted to delay the update until a compatible solution is found;
  • access control: if a particular user or system cannot support an authentication mechanism (e.g. multi-factor authentication (MFA)) due to technical limitations, an exception might be granted while alternative measures are implemented; and
  • encryption: if a legacy system does not support encryption, an exception might be granted until the system is replaced.
• Records of the exception request and approval, along with details of the compensatory controls implemented.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.