4.3.3 The relevant entities shall implement a process for managing and making use of information received …

Requirement

The relevant entities shall implement a process for managing and making use of information received from the CSIRTs or, where applicable, the competent authorities, concerning incidents, vulnerabilities, threats or possible mitigation measures.

Guidance

• Implement a process for managing and making use of information received from the CSIRTs. Consider the following steps (indicative, non-exhaustive list):
  • designate a point of contact with the CSIRT;
  • ensure that the point of contact has sufficient knowledge concerning incidents and threat intelligence.
  • classify incoming information into categories such as incidents, vulnerabilities, threats and mitigation measures.
  • assign priority levels based on severity and potential impact on the entity, if the information is relevant or applicable
  • have the CSIRT contact point review the information for relevance and urgency.
  • validate information against internal logs, threat intelligence feeds and existing security policies.
  • for vulnerabilities and threats, if applicable, collaborate with relevant teams (IT, security, operations) to develop a mitigation strategy;
  • update or create incident response plans based on the nature of the threats or incidents reported in accordance with point 3.5 of the Annex to the regulation.
  • where appropriate, implement the mitigation measures and communicate with the relevant stakeholders in accordance with point 3.5 of the Annex to the regulation.
  • share insights and feedback on incidents and mitigations with the CSIRT on a voluntary basis.

Examples of evidence

• Previous communications with CSIRTs or, where applicable, the competent authorities, for example emails, correspondence and meeting minutes.
• Evidences that the point of contact has sufficient knowledge concerning incidents and threat intelligence.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -