2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …

Requirement

The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Compliance monitoring should take place at least annually, taking into account:
  • significant incidents, if any;
  • changes to the environment of operation;
  • changes to the threat landscape and cybersecurity legal and regulatory requirements;
  • changes to standards; and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
• Evidence that reports of lessons learned or root cause analysis of past incidents, if any, were taken into account.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.