2.3 Independent review of information and network security

Requirement

The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.

Guidance

• Make sure that the independent review is conducted by a person or persons with the appropriate competences (indicative, non-exhaustive list):
  • cybersecurity technical knowledge, for example cybersecurity frameworks (ISO/IEC 27001, National Institute of Standards and Technology (NIST) cybersecurity framework, etc.),
  • industry knowledge,
  • risk assessment skills,
  • compliance and regulatory knowledge, for example the NIS2 Directive, the GDPR and the Digital Operational Resilience Act,
  • good understanding of good practices in auditing and
  • good understanding of when technical certification and conformance are required and must be documented in the conformance and compliance report, to ensure that global standards are implemented correctly.

Examples of evidence

• Documented results of the review or audit.
• Evidence of the competences of the independent reviewers, for example professional experience and academic qualifications, certifications such as certified information systems auditor, certified information systems security professional, certified information security manager, etc.

Requirement

The relevant entities shall develop and maintain processes to conduct independent reviews which shall be carried out by individuals with appropriate audit competence. Where the independent review is conducted by staff members of the relevant entity, the persons conducting the reviews shall not be in the line of authority of the personnel of the area under review. If the size of the relevant entities does not allow such separation of line of authority, the relevant entities shall put in place alternative measures to guarantee the impartiality of the reviews.

Guidance

• Set up a process for independent review of information and network security, including (indicative and non-exhaustive list):
  • scope and purpose of the independent reviews (e.g. compliance, risk assessment, policy adherence);
  • methodology of the reviews (e.g. standardised checklist, standard based, ad hoc, how it addresses processes that will be tested in real time for conformance (e.g. cloud service) or those that will be periodically evaluated);
  • review committee’s role;
  • frequency of the independent reviews;
  • who should carry out independent reviews (internal or external); and
  • templates for independent review reports.
• Maintain independence in line with point 2.3.2 of the Annex to the regulation;
• Where appropriate, consider alternative measures to the separation of line of authority (indicative and non-exhaustive list):
  • review personnel rotation;
  • set up a review committee with members from different departments;
  • external third-party review service provider.

Examples of evidence

• Documented process for independent review of information and network security.
• Conflict of interest declarations.
• Contracts with external third-party review service providers.
• Detailed independent review plans.

Requirement

The results of the independent reviews, including the results from the compliance monitoring pursuant to point

Requirement

The independent reviews shall take place at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Independent reviews should take place at least annually, taking into account:
  • significant incidents, if any;
  • changes to the environment of operation;
  • changes to the threat landscape and cybersecurity legal and regulatory requirements; and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Independent review reports documenting findings, recommendations and actions taken in response.
• Summaries of previous independent reviews, highlighting the scope and frequency.
• Records of significant incidents that occurred in the past year, along with any corresponding review or analysis documentation.
• Annual independent review plans or schedules that outline the scope of independent reviews and the specific measures being evaluated.

Tips: guidance

• Make sure that the independent review process is approved by management bodies.
• Make sure that the results of the review are approved by management bodies.

Tips: examples of evidence

• Documented procedures approved by management bodies.
• Approval of the residual risks by management bodies.