12.1.3 The relevant entities shall conduct periodic reviews of the classification levels of assets and …

Requirement

The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.

Guidance

• Define criteria for reviewing the classification over time.
• Review the classification at least annually, taking into account:
  • regulatory changes; and
  • changes in the value, sensitivity and criticality of the assets throughout their life cycle.

Examples of evidence

• Documentation showing the schedule for reviews.
• Records of the most recent review and logs detailing changes made during the last review, including reclassifications and the addition/removal of assets.

Tips: guidance

• Ensure that owners of the assets are responsible for their classification.
• Communicate to personnel the classification of assets and associated protection requirements.

Tips: examples of evidence

• Personnel knowing classification levels and protection requirements for each level.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -