2.1.4 The relevant entities shall review and, where appropriate, update the risk assessment results and …

Requirement

The relevant entities shall review and, where appropriate, update the risk assessment results and the risk treatment plan at planned intervals and at least annually and when significant changes to operations or risks or significant incidents occur.

Guidance

• Review risk assessment results and risk treatment at least annually taking into account:
  • results of audits and previous reviews,
  • status of implementation of the measures described in the risk treatment plan (see the policy on the assessment of the effectiveness of measures in line with the Annex to Regulation, point 7.1.1);
  • changes to the information systems;
  • changes to the environment of operation;
  • post-incident review findings (section 3.6); and
  • trends and changes related to threats and vulnerabilities, as they may affect risks.

Examples of evidence

• Documentation of the review process.
• Review comments or change logs for the risk assessment and risk treatment plan.

Tips: guidance

• Ensure that key personnel use the risk management methodology and tools.
• Overall, the entity has four risk treatment options associated with each risk. Each option should be accompanied by specific risk treatment measures (indicative, non-exhaustive list of examples):
  • Risk avoidance: as a measure to treat this risk, the entity might choose to eliminate activities or conditions that expose the entity to this risk, for example, discontinuing the use of a vulnerable software application.
  • Risk mitigation: as a measure to treat this risk, the entity might choose to implement measures to reduce the likelihood or impact of such a risk. This can include installing firewalls, using encryption and conducting regular security training for employees.
  • Risk transfer or sharing: as a measure to treat this risk, the entity might choose to shift parts of the risk impact to another party, typically through insurance or outsourcing certain functions to third-party providers. However, it is important to note that such arrangements do not eliminate the entity’s overall accountability or legal obligations regarding the risk. For instance, purchasing cyber insurance may cover potential data breach costs, but the entity remains responsible for implementing appropriate security measures and complying with data protection regulations.
  • Risk acceptance: as a measure to treat this risk, the entity might choose to acknowledge the risk and decide to accept it without taking any specific action, often because the cost of mitigation is higher than the potential impact. This approach is usually accompanied by a contingency plan to manage the risk if it materialises. The approach should be clearly documented, supported by a realistic estimation of potential costs and including financial provisions to address the impact should the risk materialise.
• Make sure that the risk from vulnerabilities assigned to the highest classification (e.g. ‘critical’ in the common vulnerability scoring system (CVSS)) or equivalent is not accepted, if possible (section 6.10).
• Concerning the risk treatment plans, the entity might additionally take into account:
  • findings of the review;
  • implementation steps; and
  • resources needed.
• Manage any exceptions in the risk treatment plans’ implementation.

Tips: examples of evidence

• Documented action plans developed in response to review findings.
• Key personnel knowing the main risks (e.g. evidence from emails, interviews and awareness-raising sessions).
• Documented risk treatment plan implementation exceptions.
• Risk register.

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

3. Povezani propisi

Povezani zadaci

• ENISA -