2.3.4 The independent reviews shall take place at planned intervals and when significant incidents or …

Requirement

The independent reviews shall take place at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Independent reviews should take place at least annually, taking into account:
  • significant incidents, if any;
  • changes to the environment of operation;
  • changes to the threat landscape and cybersecurity legal and regulatory requirements; and
  • changes to the policy on the security of network and information systems and/or topic-specific policies.

Examples of evidence

• Independent review reports documenting findings, recommendations and actions taken in response.
• Summaries of previous independent reviews, highlighting the scope and frequency.
• Records of significant incidents that occurred in the past year, along with any corresponding review or analysis documentation.
• Annual independent review plans or schedules that outline the scope of independent reviews and the specific measures being evaluated.

Tips: guidance

• Make sure that the independent review process is approved by management bodies.
• Make sure that the results of the review are approved by management bodies.

Tips: examples of evidence

• Documented procedures approved by management bodies.
• Approval of the residual risks by management bodies.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.