3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their …

Requirement

The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures and to incident handling, detection and response procedures.

Guidance

• Analyse the post-incident review findings to identify gaps and weaknesses in the entity’s network and information security status.
• Make sure that the identified gaps and weaknesses feed back to the risk assessment and risk treatment plan (Annex to the regulation, point 2.1).
• Assess whether existing risk treatment measures were effective in preventing or mitigating the incident.
• Document the findings and lessons learnt from each post-incident review comprehensively.
• Consider whether information security requirements have been met throughout the handling of a cybersecurity incident or whether measures may need to be taken to restore them (e.g. resetting passwords for emergency administrative access).

Examples of evidence

• Post-incident review reports that detail findings, lessons learnt and recommendations for improvement following security incidents.
• Analysis, resolution and mitigation measures taken, communicated to all relevant personnel.
• Updated risk assessment and risk treatment plan, which includes findings of the post-incident reviews.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

3. Susiję teisės aktai

Susietos užduotys

• ENISA -