4.2.4 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …

Requirement

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall ensure sufficient availability of resources by at least partial redundancy of the following: (a) network and information systems; (b) assets, including facilities, equipment and supplies; (c) personnel with the necessary responsibility, authority and competence; (d) appropriate communication channels.

Guidance

• Define minimum resources needed to ensure at least partial redundancy for each of points (a), (b), (c) and (d). These may include the following:
  • network and information systems: one or more of the following (indicative, non-exhaustive list):
    • multiple internet service providers,
    • load balancing,
    • mirrored servers,
    • virtualisation,
    • redundant array of independent disks;
  • assets: one or more of the following (indicative, non-exhaustive list):
    • shared workspaces,
    • backup locations,
    • spare equipment,
    • multiple suppliers for the same categories of products;
  • personnel: one or more of the following (indicative, non-exhaustive list):
    • job rotation,
    • backup assignments,
    • emergency drills;
  • multiple communication platforms, for example social media, messaging apps and email; and
  • multiple methods to power a site, either through multiple electrical providers or with a combination of electrical providers and backup mechanisms, such as generators.

Examples of evidence

• One or more of the above mechanisms are in place.

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.