6.4.4 The relevant entities shall review and, where appropriate, update the procedures at planned …

Requirement

The relevant entities shall review and, where appropriate, update the procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Guidance

• Review the change management procedures at least once every two years.
• Make sure that the management procedures cover planned and unplanned changes and the development phase, when applicable.
• Ensure that the process is not bypassed.

Examples of evidence

• Review plans or schedules.
• Up to date change management procedures, review comments and/or change logs.
• Evidence of approval and monitoring of maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location.
• Logs of all changes made to the procedures, including details, approvals and implementation dates.
• Audit trails and compliance records from internal and external audits.
• Logs of significant incidents to confirm whether they include documentation of reviews and updates to the change, repair and maintenance procedures.
• Reports from post-incident reviews that document any necessary adjustments to the procedures following significant incidents.
• Records showing how changes and updates to the procedures were implemented and reviewed.

Tips: guidance

• Perform and log: (a) changes to, (b) maintenance of and (c) repairs to network and information systems, with approved and controlled tools.
• Put change management procedures in place according to licensing agreements.
• Upon changes to assets, update the asset inventory (Annex to the regulation, point 12.4) and documentation.
• Upon changes to risk management measures, update the risk treatment plan (Annex to the regulation, point 2.1.1).
• Inform the customer of significant changes to network and information systems that affect the services offered. This information only needs to be provided if it is beneficial for customers.
• Ensure availability of the required maintenance skills, resources and spare parts, including external support.
• Prevent the unauthorised removal of maintenance equipment containing information related to the entity by (indicative, non-exhaustive list):
  • verifying that no information related to the entity is contained in the equipment;
  • sanitising or destroying the equipment;
  • retaining the equipment within the facility; or
  • obtaining an exemption from authorised personnel or roles explicitly authorising removal of the equipment from the facility.
• Provide remote access via out-of-band (OOB) connection in the event that the standard connection does not work.
• Regularly test OOB connections to ensure they function as expected during an outage.
• If an incident, in the sense of Article 23 of the NIS2 Directive, involves subsequent actions that entail system changes, then notify the competent authorities of these changes in accordance with the national reporting procedure.

Tips: examples of evidence

• Evidence that MFA is in place for remote change, repair and maintenance procedures.
• Logs and records that prove the use of approved tools.
• Evidence that the procedures mention the licencing agreement.
• Up-to-date asset inventory.
• Up-to-date risk-treatment plan.
• Documentation of a customer update on significant changes.
• Evidence of previous training on change management and system maintenance.
• Evidence of sanitisation procedures.
• Evidence that the entity maintains a spare parts for key components of its network and information system.
• Notifications to defined personnel or roles of the date and time of planned maintenance.
• Network architecture diagram that proves the existence of OOB connections.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• ENISA -