1.1.2 The network and information system security policy shall be reviewed and, where appropriate …

Requirement

The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.

Guidance

• Review the policy on the security of network and information systems at least annually, taking into account (indicative, non-exhaustive list):
  • updates to the risk assessment results and the risk treatment plan (Annex to the regulation, point 2.1.4);
  • relevant changes in legislation (laws, regulations and other measures imposed by national competent authorities);
  • recommendations provided by relevant authorities;
  • relevant changes in industry good practices;
  • feedback from interested parties;
  • findings of compliance monitoring (section 2.2) and of independent reviews (Annex to the regulation, point 2.3), including policy violations or policy exceptions;
  • incidents, even those affecting similar entities in the sector.
• Update the policy on the security of network and information systems and topic-specific policies, in line with new findings that could affect the entity’s approach to managing information security, including (9):
  • updates to the risk assessment results and the risk treatment plan (Annex to the regulation, point 2.1.4);
  • changes to the network and information systems;
  • changes to the environment of operation;
  • problems identified during the implementation of the policy;
  • findings of compliance monitoring (Annex to the regulation, point 2.2.1) and of independent reviews (Annex to the regulation, point 2.3), including policy violations or policy exceptions;
  • the status of preventive and corrective actions;
  • trends related to threats and vulnerabilities; and
  • known reported security incidents.
• All updates to the policy should be based on the covered entity's unique security risks identified through its risk assessment.
• Obtain approval for the revised policy and the policy exceptions by the management bodies.

Examples of evidence

• Review comments or change logs for the policy on the security of network and information systems and topic-specific policies.
• Documentation of the review process of the requirements listed in point 1.1.1 of the Annex to the regulation.
• Up-to-date policy on the security of network and information systems and topic-specific policies.
• Evidence that any updates to the policy on the security of network and information systems and any policy exceptions, are approved by management bodies and a record is kept.
• Evidence that any updates to the topic-specific policies are approved by an appropriate level of management and a record is kept.
• Records of the management review.

Tips: guidance

• Analyse the policy on the security of network and information systems for compliance with:
  • legislative, regulatory and contractual requirements;
  • awareness and training requirements (Annex to the regulation, points 8.1 and 8.2); and
  • business continuity requirements (Annex to the regulation, point 4.1).
• Define procedures to facilitate the implementation of the policy on the security of network and information systems and associated measures.
• Examine documentation of post-incident reviews for significant incidents (10) that include participation and input from management bodies.
• Ensure that the policy is:
  • protected in terms of confidentiality (on a need-to-know basis), integrity, availability and authenticity;
  • managed properly so the information is complete, correct, understandable, easily identifiable and retrievable.

Tips: examples of evidence

• Documented policy on the security of network and information systems, including networks and services in scope, assets supporting them and the security objectives, including applicable laws and regulations, accessible to personnel.
• Documented topic-specific policies, including applicable laws and regulations, accessible to relevant personnel.
• Evidence of cybersecurity training of management, for instance:
  • training records;
  • workshop and seminar attendance; and
  • continuous learning materials.
• Internal communication logs, ad hoc reports or communication policy or records showing regular briefings or updates provided to management bodies regarding cybersecurity matters or during significant incidents.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• ENISA -