7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken by the relevant entity are effectively implemented and maintained.

Guidance

• Take into account industry-recognised standards when developing the policy and procedures for assessing the efficient implementation of the measures (72).
• Implement a policy for assessing the effectiveness of implementation of measures that is proportionate to the risk posture of the entity in line with the risk assessment.

Examples of evidence

• Documented policy and procedures for effectiveness assessments based on good practices and standards (73).

Mapping to standards and frameworks

1. Pārskats

1.1 Atsauces

• ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
• GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
• ID.IM-01 Improvements are identified from evaluations
• ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
• ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

3. Saistītie tiesību akti

Saistītie uzdevumi

• ENISA -