+2.3. Independent review of information and network security
---+2.3.1. The relevant entities shall review independently their approach to managing network and …
---+2.3.2. The relevant entities shall develop and maintain processes to conduct independent reviews …
---+2.3.3. The results of the independent reviews, including the results from the compliance monitoring …
---+2.3.4. The independent reviews shall take place at planned intervals and when significant incidents …

2.3. Independent review of information and network security

2.3.   Independent review of information and network security

1. Vue d’ensemble

,
2.3.1. The relevant entities shall review independently their approach to managing network and …

2.3.1.

 The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.
2.3.2. The relevant entities shall develop and maintain processes to conduct independent reviews …

2.3.2.

 The relevant entities shall develop and maintain processes to conduct independent reviews which shall be carried out by individuals with appropriate audit competence. Where the independent review is conducted by staff members of the relevant entity, the persons conducting the reviews shall not be in the line of authority of the personnel of the area under review. If the size of the relevant entities does not allow such separation of line of authority, the relevant entities shall put in place alternative measures to guarantee the impartiality of the reviews.
2.3.3. The results of the independent reviews, including the results from the compliance monitoring …

2.3.3.

 The results of the independent reviews, including the results from the compliance monitoring pursuant to point 2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.
2.3.4. The independent reviews shall take place at planned intervals and when significant incidents …

2.3.4.

 The independent reviews shall take place at planned intervals and when significant incidents or significant changes to operations or risks occur.

1.1 Références

1.2 Exigences identifiées

1.3 Normes associées

2. Exigences identifiées

Exigences

3. Normes associées

Normes

Tickets liés

Liens
is related to 2.3 Independent review of information and network security