+3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
---+3.1. Incident handling policy
------+3.1.1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant …
------+3.1.2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and …
------+3.1.3. The roles, responsibilities and procedures laid down in the policy shall be tested and …
---+3.2. Monitoring and logging
------+3.2.1. The relevant entities shall lay down procedures and use tools to monitor and log activities …
------+3.2.2. To the extent feasible, monitoring shall be automated and carried out either continuously or …
------+3.2.3. Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain …
------+3.2.4. The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate …
------+3.2.5. The relevant entities shall maintain and back up logs for a predefined period and shall …
------+3.2.6. To the extent feasible, the relevant entities shall ensure that all systems have …
------+3.2.7. The procedures as well as the list of assets that are being logged shall be reviewed and …
---+3.3. Event reporting
------+3.3.1. The relevant entities shall put in place a simple mechanism allowing their employees …
------+3.3.2. The relevant entities shall, where appropriate, communicate the event reporting mechanism to …
---+3.4. Event assessment and classification
------+3.4.1. The relevant entities shall assess suspicious events to determine whether they constitute …
------+3.4.2. For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) …
---+3.5. Incident response
------+3.5.1. The relevant entities shall respond to incidents in accordance with documented procedures …
------+3.5.2. The incident response procedures shall include the following stages: (a) incident …
------+3.5.3. The relevant entities shall establish communication plans and procedures: (a) with the …
------+3.5.4. The relevant entities shall log incident response activities in accordance with the …
------+3.5.5. The relevant entities shall test at planned intervals their incident response procedures.
---+3.6. Post-incident reviews
------+3.6.1. Where appropriate, the relevant entities shall carry out post-incident reviews after …
------+3.6.2. The relevant entities shall ensure that post-incident reviews contribute to improving their …
------+3.6.3. The relevant entities shall review at planned intervals if incidents led to post-incident …
|
3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Standard correlati
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Standard correlati
Ticket collegati
|