2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …

Requirement

The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Compliance monitoring should take place at least annually, taking into account:
  • significant incidents, if any;
  • changes to the environment of operation;
  • changes to the threat landscape and cybersecurity legal and regulatory requirements;
  • changes to standards; and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
• Evidence that reports of lessons learned or root cause analysis of past incidents, if any, were taken into account.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -