2.3.2 The relevant entities shall develop and maintain processes to conduct independent reviews which …

Requirement

The relevant entities shall develop and maintain processes to conduct independent reviews which shall be carried out by individuals with appropriate audit competence. Where the independent review is conducted by staff members of the relevant entity, the persons conducting the reviews shall not be in the line of authority of the personnel of the area under review. If the size of the relevant entities does not allow such separation of line of authority, the relevant entities shall put in place alternative measures to guarantee the impartiality of the reviews.

Guidance

• Set up a process for independent review of information and network security, including (indicative and non-exhaustive list):
  • scope and purpose of the independent reviews (e.g. compliance, risk assessment, policy adherence);
  • methodology of the reviews (e.g. standardised checklist, standard based, ad hoc, how it addresses processes that will be tested in real time for conformance (e.g. cloud service) or those that will be periodically evaluated);
  • review committee’s role;
  • frequency of the independent reviews;
  • who should carry out independent reviews (internal or external); and
  • templates for independent review reports.
• Maintain independence in line with point 2.3.2 of the Annex to the regulation;
• Where appropriate, consider alternative measures to the separation of line of authority (indicative and non-exhaustive list):
  • review personnel rotation;
  • set up a review committee with members from different departments;
  • external third-party review service provider.

Examples of evidence

• Documented process for independent review of information and network security.
• Conflict of interest declarations.
• Contracts with external third-party review service providers.
• Detailed independent review plans.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -