10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall ensure that their employees and direct suppliers and service providers, wherever applicable, understand and commit to their security responsibilities, as appropriate for the offered services and the job and in line with the relevant entities’ policy on the security of network and information systems.

Guidance

• Define clear security roles and responsibilities for employees, aligned with the entity’s security policies and each employee’s functional role . Define relevant security responsibilities for direct suppliers and service providers, within the scope of contractual obligations, ensuring they are appropriate to the nature of the services provided and aligned with the entity’s overall security requirements.
• Establish onboarding and continuous education programmes that include both security awareness and role-specific cybersecurity training tailored to different risk exposures.
• Implement periodic assessments to evaluate understanding of security responsibilities, supported by mandatory refresher training as needed.
• Ensure that security responsibilities are formally documented and integrated into job descriptions, contractual agreements and performance review processes. Incorporate relevant security responsibilities into contractual agreements or service-level agreements (SLA), for direct suppliers and service providers with clear language regarding expectations and compliance requirements.
• Promote a culture of accountability by requiring formal acknowledgement of security obligations and by linking compliance to incentives and disciplinary measures, where appropriate.
• Develop and maintain a centralized repository of training records, acknowledgements, certifications and contractual clauses to demonstrate compliance and facilitate audits.
• Require suppliers and service providers to designate responsible contacts for cybersecurity and encourage or mandate participation in relevant security briefings or training programmes provided by the entity.

Examples of evidence

• List of employees whose roles require specific security skills and their assignment to roles.
• Documented evidence of regular training sessions on security of network and information systems for employees, direct suppliers and service providers, wherever applicable. This includes attendance records, training materials and feedback forms.
• Signed acknowledgements from employees, direct suppliers and service providers, wherever applicable, confirming they have read, understood and agreed to comply with the policy.
• Reports from internal or external audits assessing the understanding and implementation of security responsibilities among employees, direct suppliers and service providers, wherever applicable.
• Inclusion of security responsibilities, where relevant, in employee performance reviews and evaluations.
• Contracts with direct suppliers and service providers that include clauses on security responsibilities and compliance with the entity’s policies or written justifications by the direct supplier or service provider in cases where these clauses do not exist in the contract.
• Certifications or attestations of cybersecurity skills from nationally recognized or accredited bodies confirming that a person fulfils specific requirements regarding cybersecurity knowledge and skills.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

3. Susiję teisės aktai

Susietos užduotys

• ENISA -