3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their …

Requirement

The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures and to incident handling, detection and response procedures.

Guidance

• Analyse the post-incident review findings to identify gaps and weaknesses in the entity’s network and information security status.
• Make sure that the identified gaps and weaknesses feed back to the risk assessment and risk treatment plan (Annex to the regulation, point 2.1).
• Assess whether existing risk treatment measures were effective in preventing or mitigating the incident.
• Document the findings and lessons learnt from each post-incident review comprehensively.
• Consider whether information security requirements have been met throughout the handling of a cybersecurity incident or whether measures may need to be taken to restore them (e.g. resetting passwords for emergency administrative access).

Examples of evidence

• Post-incident review reports that detail findings, lessons learnt and recommendations for improvement following security incidents.
• Analysis, resolution and mitigation measures taken, communicated to all relevant personnel.
• Updated risk assessment and risk treatment plan, which includes findings of the post-incident reviews.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.