10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …

Requirement

The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure that all employees, direct suppliers and service providers, wherever applicable, understand and follow the standard cyber hygiene practices that the entities apply pursuant to point 8.1.; (b) mechanisms to ensure that all users with administrative or privileged access are aware of and act in accordance with their roles, responsibilities and authorities; (c) mechanisms to ensure that members of management bodies understand and act in accordance with their role, responsibilities and authorities regarding network and information system security; (d) mechanisms for hiring personnel qualified for the respective roles, such as reference checks, vetting procedures, validation of certifications or written tests.

Guidance

• Implement regular awareness raising on cyber hygiene practices for users, tailored to different roles and responsibilities (Annex to the regulation, point 8.1). Wherever applicable, require employees of direct suppliers and service providers, to follow similar awareness raising on cyber hygiene via contractual clauses.
• Communicate clear and concise cyber hygiene practices for users to all employees, suppliers and service providers. Require acknowledgement of receipt and understanding (Annex to the regulation, point 8.1).
• Consider specialised training for users with administrative or privileged access, focusing on their specific responsibilities (Annex to the regulation, point 8.2).
• Establish performance metrics related to security responsibilities and include them in management evaluations.
• Hold regular briefings for members of management bodies on the importance of network and information system security, their specific responsibilities and the potential impact of incidents (section 8.2).
• Conduct thorough reference checks, where appropriate, to verify the candidate’s previous experience and performance in similar roles.
• Consider vetting procedures, including background checks (section 10.2), to ensure the candidate’s suitability for the role.
• Validate any relevant certifications claimed by the candidate, to ensure they are current and legitimate.
• Use written tests or practical assessments to evaluate the candidate’s knowledge and skills related to network and information system security.
• Use interview panels, where appropriate, that also include security experts, to assess the candidate’s technical and behavioural competencies.

Examples of evidence

• Training and awareness raising material such as videos, slides, emails, newsletters, posters and intranet announcements.
• Documented records showing that all users with administrative or privileged access were properly informed and are aware of and are following their network and information security roles, responsibilities and authorities.
• Contractual agreements, the policy on the security of network and information systems, terms and conditions, code of conduct and other documentation confirming that all users have understood and are following the standard cyber hygiene practices for users (signed employment contracts and any proof of employees having been informed of their responsibilities relating to network and information security).
• Records of security training sessions provided to employees, including attendance logs and training schedules.
• Evidence, for example attendance certificates where relevant, that suppliers and service providers receive security training relevant to their roles.
• Mechanisms for hiring qualified personnel (e.g. reference check, validation of certifications and written tests) in place.
• Use of relevant cybersecurity frameworks and standards along with widely recognised quality management and capability maturity models and standards.

1. Áttekintés

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

3. Kapcsolódó szabályozások

Kapcsolt feladatok

• ENISA -