+3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Requirement

The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Guidance

  • Conduct an annual review or a review after significant incidents, to determine if an incident has led to a post-incident review.

Examples of evidence

  • Documented plans or schedules for future reviews.

Tips: guidance

  • Determine the composition of the review team, including members from relevant departments such as IT, security, legal and management bodies.
  • Review existing network and information security policies, topic-specific policies relevant to the incident, incident handling procedures and policy and incident response procedures in light of the lessons learnt from post-incident reviews.

Tips: examples of evidence

  • Minutes of the post-incident review team.
  • Evidence of updates to network and information security or topic-specific policies and procedures based on the lessons learnt from post-incident reviews.

1. Pārskats

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

Prasības

3. Saistītie tiesību akti

Tiesību akti

Saistītie uzdevumi

Saites
is related to 3.6.3. Attiecīgās vienības plānotos intervālos pārbauda, vai pēc incidentiem ir veikta pēcincidenta …
  • ENISA -

    EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

    DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.