7.3 The relevant entities shall review and, where appropriate, update the policy and procedures at …

Requirement

The relevant entities shall review and, where appropriate, update the policy and procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Guidance

• Review policy and procedures for the assessment of the effectiveness of the measures at least every two years, taking into account:
  • changes to the information systems;
  • changes to the environment of operation; and
  • trends related to threats and vulnerabilities (take into account root cause analysis) (76).
• Update the policy and procedures based on findings from security tests (Annex to the regulation, point 6.5.2 (c) ) and the independent review of the policy on the security of the network and information systems (Annex to the regulation, point 2.3.3), if applicable.
• Take into account the results of the assessment and consider them when identifying and prioritising appropriate risk-treatment options and measures (Annex to the regulation, point 2.1.3).

Examples of evidence

• Logs or records from previous policy reviews.
• Plans or schedules for future effectiveness assessment reviews.
• Risk-treatment plan that takes into account the results of the effectiveness assessments.
• Minutes from meetings where security-testing results are discussed and the effectiveness of other policies is reviewed and improvements to them are discussed based on these results.
• Records showing updates to other policies and procedures with a view to assessing their effectiveness.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.