7.3 The relevant entities shall review and, where appropriate, update the policy and procedures at …

Requirement

The relevant entities shall review and, where appropriate, update the policy and procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Guidance

• Review policy and procedures for the assessment of the effectiveness of the measures at least every two years, taking into account:
  • changes to the information systems;
  • changes to the environment of operation; and
  • trends related to threats and vulnerabilities (take into account root cause analysis) (76).
• Update the policy and procedures based on findings from security tests (Annex to the regulation, point 6.5.2 (c) ) and the independent review of the policy on the security of the network and information systems (Annex to the regulation, point 2.3.3), if applicable.
• Take into account the results of the assessment and consider them when identifying and prioritising appropriate risk-treatment options and measures (Annex to the regulation, point 2.1.3).

Examples of evidence

• Logs or records from previous policy reviews.
• Plans or schedules for future effectiveness assessment reviews.
• Risk-treatment plan that takes into account the results of the effectiveness assessments.
• Minutes from meetings where security-testing results are discussed and the effectiveness of other policies is reviewed and improvements to them are discussed based on these results.
• Records showing updates to other policies and procedures with a view to assessing their effectiveness.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -