ENISA
Šajā valodā nav dokumentu, tiek rādīti angļu valodā.
ENISA Secure by Design and Default Playbook
ENISA Technical Advisory for Software Bill of Materials
NIS2 Technical Implementation Guidance
Uzdevumi
| Nosaukums |
Avots |
|
+ NIS2 Technical Implementation Guidance
|
|
|
---+ Executive summary
|
|
|
---+ Introduction
|
|
|
---+ 1. Policy on the security of network and information systems
|
|
|
------+ 1.1 Policy on the security of network and information systems
|
|
|
---------+ 1.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security …
|
|
|
---------+ 1.1.2 The network and information system security policy shall be reviewed and, where appropriate …
|
|
|
------+ 1.2 Roles, responsibilities and authorities
|
|
|
---------+ 1.2.1 As part of their policy on the security of network and information systems referred to in point …
|
|
|
---------+ 1.2.2 The relevant entities shall require all personnel and third parties to apply network and …
|
|
|
---------+ 1.2.3 At least one person shall report directly to the management bodies on matters of network and …
|
|
|
---------+ 1.2.4 Depending on the size of the relevant entities, network and information system security shall be …
|
|
|
---------+ 1.2.5 Conflicting duties and conflicting areas of responsibility shall be segregated, where applicable.
|
|
|
---------+ 1.2.6 Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by …
|
|
|
---+ 2. Risk management policy
|
|
|
------+ 2.1 Risk management framework
|
|
|
---------+ 2.1.1 For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 2.1.2 For the purpose of point 2.1.1, the relevant entities shall establish procedures for …
|
|
|
---------+ 2.1.3 When identifying and prioritising appropriate risk treatment options and measures, the relevant …
|
|
|
---------+ 2.1.4 The relevant entities shall review and, where appropriate, update the risk assessment results and …
|
|
|
------+ 2.2 Compliance monitoring
|
|
|
---------+ 2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …
|
|
|
---------+ 2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …
|
|
|
---------+ 2.2.3 The relevant entities shall perform the compliance monitoring at planned intervals and when …
|
|
|
------+ 2.3 Independent review of information and network security
|
|
|
---------+ 2.3.1 The relevant entities shall review independently their approach to managing network and information …
|
|
|
---------+ 2.3.2 The relevant entities shall develop and maintain processes to conduct independent reviews which …
|
|
|
---------+ 2.3.3 The results of the independent reviews, including the results from the compliance monitoring …
|
|
|
---------+ 2.3.4 The independent reviews shall take place at planned intervals and when significant incidents or …
|
|
|
------+ 2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …
|
|
|
---+ 3. Incident handling
|
|
|
------+ 3.1 Incident handling policy
|
|
|
---------+ 3.1.1 For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 3.1.2 The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster …
|
|
|
---------+ 3.1.3 The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed …
|
|
|
------+ 3.2 Monitoring and logging
|
|
|
---------+ 3.2.1 The relevant entities shall lay down procedures and use tools to monitor and log activities on …
|
|
|
---------+ 3.2.2 To the extent feasible, monitoring shall be automated and carried out either continuously or in …
|
|
|
---------+ 3.2.3 Based on the procedures referred to in point 3.2.1., the relevant entities shall maintain, document …
|
|
|
---------+ 3.2.4 The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the …
|
|
|
---------+ 3.2.5 The relevant entities shall maintain and back up logs for a predefined period and shall protect …
|
|
|
---------+ 3.2.6 To the extent feasible, the relevant entities shall ensure that all systems have synchronised time …
|
|
|
---------+ 3.2.7 The procedures as well as the list of assets that are being logged shall be reviewed and, where …
|
|
|
------+ 3.3 Event reporting
|
|
|
---------+ 3.3.1 The relevant entities shall put in place a simple mechanism allowing their employees, suppliers and …
|
|
|
---------+ 3.3.2 The relevant entities shall, where appropriate, communicate the event reporting mechanism to their …
|
|
|
------+ 3.4 Event assessment and classification
|
|
|
---------+ 3.4.1 The relevant entities shall assess suspicious events to determine whether they constitute incidents …
|
|
|
---------+ 3.4.2 For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) carry …
|
|
|
------+ 3.5 Incident response
|
|
|
---------+ 3.5.1 The relevant entities shall respond to incidents in accordance with documented procedures and in a …
|
|
|
---------+ 3.5.2 The incident response procedures shall include the following stages: (a) incident containment, to …
|
|
|
---------+ 3.5.3 The relevant entities shall establish communication plans and procedures: (a) with the Computer …
|
|
|
---------+ 3.5.4 The relevant entities shall log incident response activities in accordance with the procedures …
|
|
|
---------+ 3.5.5 The relevant entities shall test at planned intervals their incident response procedures.
|
|
|
------+ 3.2.1 and record evidence.
|
|
|
------+ 3.6 Post-incident reviews
|
|
|
---------+ 3.6.1 Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from …
|
|
|
---------+ 3.6.2 The relevant entities shall ensure that post-incident reviews contribute to improving their …
|
|
|
---------+ 3.6.3 The relevant entities shall review at planned intervals if incidents led to post-incident reviews.
|
|
|
---+ 4. Business continuity and crisis management
|
|
|
------+ 4.1 Business continuity and disaster recovery plan
|
|
|
---------+ 4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 4.1.2 The relevant entities’ operations shall be restored according to the business continuity and …
|
|
|
---------+ 4.1.3 The relevant entities shall carry out a business impact analysis to assess the potential impact of …
|
|
|
---------+ 4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …
|
|
|
------+ 4.2 Backup and redundancy management
|
|
|
---------+ 4.2.1 The relevant entities shall maintain backup copies of data and provide sufficient available …
|
|
|
---------+ 4.2.2 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
|
|
|
---------+ 4.2.3 The relevant entities shall perform regular integrity checks on the backup copies.
|
|
|
---------+ 4.2.4 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
|
|
|
---------+ 4.2.5 Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources …
|
|
|
---------+ 4.2.6 The relevant entities shall carry out regular testing of the recovery of backup copies and …
|
|
|
------+ 4.3 Crisis management
|
|
|
---------+ 4.3.1 The relevant entities shall put in place a process for crisis management.
|
|
|
---------+ 4.3.2 The relevant entities shall ensure that the crisis management process addresses at least the …
|
|
|
---------+ 4.3.3 The relevant entities shall implement a process for managing and making use of information received …
|
|
|
---------+ 4.3.4 The relevant entities shall test, review and, where appropriate, update the crisis management plan …
|
|
|
---+ 5. Supply chain security
|
|
|
------+ 5.1 Supply chain security policy
|
|
|
---------+ 5.1.1 For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 5.1.2 As part of the supply chain security policy referred to in point 5.1.1, the relevant entities shall …
|
|
|
---------+ 5.1.3 When establishing their supply chain security policy, relevant entities shall take into account the …
|
|
|
---------+ 5.1.4 Based on the supply chain security policy and taking into account the results of the risk …
|
|
|
---------+ 5.1.5 The relevant entities shall take into account the elements referred to in point 5.1.2 and 5.1.3. as …
|
|
|
---------+ 5.1.6 The relevant entities shall review the supply chain security policy and monitor, evaluate and …
|
|
|
---------+ 5.1.7 For the purpose of point 5.1.6., the relevant entities shall: (a) regularly monitor reports on the …
|
|
|
------+ 5.2 Directory of suppliers and service providers
|
|
|
---+ 6. Security in network and information systems acquisition, development and maintenance
|
|
|
------+ 6.1 Security in acquisition of ICT services or ICT products
|
|
|
---------+ 6.1.1 For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 6.1.2 For the purpose of point 6.1.1., the processes referred to in point 6.1.1. shall include: (a) …
|
|
|
---------+ 6.1.3 The relevant entities shall review and, where appropriate, update the processes at planned …
|
|
|
------+ 6.2 Secure development life cycle
|
|
|
---------+ 6.2.1 Before developing a network and information system, including software, the relevant entities shall …
|
|
|
---------+ 6.2.2 For the purpose of point 6.2.1., the relevant entities shall: (a) carry out an analysis of security …
|
|
|
---------+ 6.2.3 For outsourced development of network and information systems, the relevant entities shall also …
|
|
|
---------+ 6.2.4 The relevant entities shall review and, where necessary, update their secure development rules at …
|
|
|
------+ 6.3 Configuration management
|
|
|
---------+ 6.3.1 The relevant entities shall take the appropriate measures to establish, document, implement and …
|
|
|
---------+ 6.3.2 For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in …
|
|
|
---------+ 6.3.3 The relevant entities shall review and, where appropriate, update configurations at planned …
|
|
|
------+ 6.4 Change management, repairs and maintenance
|
|
|
---------+ 6.4.1 The relevant entities shall apply change management procedures to control changes of network and …
|
|
|
---------+ 6.4.2 The procedures referred to in point 6.4.1. shall be applied for releases, modifications and …
|
|
|
---------+ 6.4.3 In the event that the regular change management procedures could not be followed due to an …
|
|
|
---------+ 6.4.4 The relevant entities shall review and, where appropriate, update the procedures at planned …
|
|
|
------+ 6.5 Security testing
|
|
|
---------+ 6.5.1 The relevant entities shall establish, implement and apply a policy and procedures for security …
|
|
|
---------+ 6.5.2 The relevant entities shall: (a) establish, based on the risk assessment carried out pursuant to …
|
|
|
---------+ 6.5.3 The relevant entities shall review and, where appropriate, update their security testing policies …
|
|
|
------+ 6.6 Security patch management
|
|
|
---------+ 6.6.1 The relevant entities shall specify and apply procedures, coherent with the change management …
|
|
|
---------+ 6.6.2 By way of derogation from point 6.6.1.(a), the relevant entities may choose not to apply security …
|
|
|
------+ 6.7 Network security
|
|
|
---------+ 6.7.1 The relevant entities shall take the appropriate measures to protect their network and information …
|
|
|
---------+ 6.7.2 For the purpose of point 6.7.1., the relevant entities shall: (a) document the architecture of the …
|
|
|
---------+ 6.7.3 The relevant entities shall review and, where appropriate, update these measures at planned …
|
|
|
------+ 6.8 Network segmentation
|
|
|
---------+ 6.8.1 The relevant entities shall segment systems into networks or zones in accordance with the results …
|
|
|
---------+ 6.8.2 For that purpose, the relevant entities shall: (a) consider the functional, logical and physical …
|
|
|
---------+ 6.8.3 The relevant entities shall review and, where appropriate, update network segmentation at planned …
|
|
|
------+ 6.9 Protection against malicious and unauthorised software
|
|
|
---------+ 6.9.1 The relevant entities shall protect their network and information systems against malicious and …
|
|
|
---------+ 6.9.2 For that purpose, the relevant entities shall in particular implement measures that detect or …
|
|
|
------+ 6.10 Vulnerability handling and disclosure
|
|
|
---------+ 6.10.1 The relevant entities shall obtain information about technical vulnerabilities in their network and …
|
|
|
---------+ 6.10.2 For the purpose of point 6.10.1., the relevant entities shall: (a) monitor information about …
|
|
|
---------+ 6.10.3 When justified by the potential impact of the vulnerability, the relevant entities shall create and …
|
|
|
---------+ 6.10.4 The relevant entities shall review and, where appropriate, update at planned intervals the channels …
|
|
|
---+ 7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
|
|
|
------+ 7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
------+ 7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk …
|
|
|
------+ 7.3 The relevant entities shall review and, where appropriate, update the policy and procedures at …
|
|
|
---+ 8. Basic cyber hygiene practices and security training
|
|
|
------+ 8.1 Awareness raising and basic cyber hygiene practices
|
|
|
---------+ 8.1.1 For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 8.1.2 For the purpose of point 8.1.1., the relevant entities shall offer to all employees, including …
|
|
|
---------+ 8.1.3 The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The …
|
|
|
------+ 8.2 Security training
|
|
|
---------+ 8.2.1 The relevant entities shall identify employees, whose roles require security relevant skill sets …
|
|
|
---------+ 8.2.2 The relevant entities shall establish, implement and apply a training program in line with the …
|
|
|
---------+ 8.2.3 The training referred to in point 8.2.1. shall be relevant to the job function of the employee and …
|
|
|
---------+ 8.2.4 The relevant entities shall apply training to staff members who transfer to new positions or roles …
|
|
|
---------+ 8.2.5 The program shall be updated and run periodically taking into account applicable policies and …
|
|
|
---+ 9. Cryptography
|
|
|
------+ 9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
------+ 9.2 The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the …
|
|
|
------+ 9.3 The relevant entities shall review and, where appropriate, update their policy and procedures at …
|
|
|
---+ 10. Human resources security
|
|
|
------+ 10.1 Human resources security
|
|
|
---------+ 10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …
|
|
|
---------+ 10.1.3 The relevant entities shall review the assignment of personnel to specific roles as referred to in …
|
|
|
------+ 10.2 Verification of background
|
|
|
---------+ 10.2.1 The relevant entities shall ensure to the extent feasible verification of the background of their …
|
|
|
---------+ 10.2.2 For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set …
|
|
|
---------+ 10.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 10.3 Termination or change of employment procedures
|
|
|
---------+ 10.3.1 The relevant entities shall ensure that network and information system security responsibilities …
|
|
|
---------+ 10.3.2 For the purpose of point 10.3.1., the relevant entities shall include in the individual’s terms and …
|
|
|
------+ 10.4 Disciplinary process
|
|
|
---------+ 10.4.1 The relevant entities shall establish, communicate and maintain a disciplinary process for handling …
|
|
|
---------+ 10.4.2 The relevant entities shall review and, where appropriate, update the disciplinary process at …
|
|
|
---+ 11. Access control
|
|
|
------+ 11.1 Access control policy
|
|
|
---------+ 11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 11.1.2 The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff …
|
|
|
---------+ 11.1.3 The relevant entities shall review and, where appropriate, update the policies at planned intervals …
|
|
|
------+ 11.2 Management of access rights
|
|
|
---------+ 11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and …
|
|
|
---------+ 11.2.2 The relevant entities shall: (a) assign and revoke access rights based on the principles of …
|
|
|
---------+ 11.2.3 The relevant entities shall review access rights at planned intervals and shall modify them based …
|
|
|
------+ 11.3 Privileged accounts and system administration accounts
|
|
|
---------+ 11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …
|
|
|
---------+ 11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …
|
|
|
---------+ 11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …
|
|
|
------+ 11.4 Administration systems
|
|
|
---------+ 11.4.1 The relevant entities shall restrict and control the use of system administration systems in …
|
|
|
---------+ 11.4.2 For that purpose, the relevant entities shall: (a) only use system administration systems for …
|
|
|
------+ 11.5 Identification
|
|
|
---------+ 11.5.1 The relevant entities shall manage the full life cycle of identities of network and information …
|
|
|
---------+ 11.5.2 For that purpose, the relevant entities shall: (a) set up unique identities for network and …
|
|
|
---------+ 11.5.3 The relevant entities shall only permit identities assigned to multiple persons, such as shared …
|
|
|
---------+ 11.5.4 The relevant entities shall regularly review the identities for network and information systems and …
|
|
|
------+ 11.6 Authentication
|
|
|
---------+ 11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on …
|
|
|
---------+ 11.6.2 For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …
|
|
|
---------+ 11.6.3 The relevant entities shall to the extent feasible use state-of-the-art authentication methods, in …
|
|
|
---------+ 11.6.4 The relevant entities shall regularly review the authentication procedures and technologies at …
|
|
|
------+ 11.7 Multi-factor authentication
|
|
|
---------+ 11.7.1 The relevant entities shall ensure that users are authenticated by multiple authentication factors …
|
|
|
---------+ 11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the …
|
|
|
---+ 12. Asset management
|
|
|
------+ 12.1 Asset classification
|
|
|
---------+ 12.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
|
|
|
---------+ 12.1.2 For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a system of …
|
|
|
---------+ 12.1.3 The relevant entities shall conduct periodic reviews of the classification levels of assets and …
|
|
|
------+ 12.2 Handling of assets
|
|
|
---------+ 12.2.1 The relevant entities shall establish, implement and apply a policy for the proper handling of …
|
|
|
---------+ 12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …
|
|
|
---------+ 12.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 12.3 Removable media policy
|
|
|
---------+ 12.3.1 The relevant entities shall establish, implement and apply a policy on the management of removable …
|
|
|
---------+ 12.3.2 The policy shall: (a) provide for a technical prohibition of the connection of removable media …
|
|
|
---------+ 12.3.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
|
|
|
------+ 12.4 Asset inventory
|
|
|
---------+ 12.4.1 The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent …
|
|
|
---------+ 12.4.2 The granularity of the inventory of the assets shall be at a level appropriate for the needs of the …
|
|
|
---------+ 12.4.3 The relevant entities shall regularly review and update the inventory and their assets and document …
|
|
|
------+ 12.5 Deposit, return or deletion of assets upon termination of employment
|
|
|
---+ 13. Environmental and physical security
|
|
|
------+ 13.1 Supporting utilities
|
|
|
---------+ 13.1.1 For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.1.2 For that purpose, the relevant entities shall, where appropriate: (a) protect facilities from power …
|
|
|
---------+ 13.1.3 The relevant entities shall test, review and, where appropriate, update the protection measures on …
|
|
|
------+ 13.2 Protection against physical and environmental threats
|
|
|
---------+ 13.2.1 For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.2.2 For that purpose, the relevant entities shall, where appropriate: (a) design and implement …
|
|
|
---------+ 13.2.3 The relevant entities shall test, review and, where appropriate, update the protection measures …
|
|
|
------+ 13.3 Perimeter and physical access control
|
|
|
---------+ 13.3.1 For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities shall …
|
|
|
---------+ 13.3.2 For that purpose, the relevant entities shall: (a) on the basis of the risk assessment carried out …
|
|
|
---------+ 13.3.3 The relevant entities shall test, review and, where appropriate, update the physical access control …
|
|
|
---+ Annex I national frameworks
|
|
|
---+ Annex II glossary
|
|
Technical Competence Requirements for CRA Notified Bodies
Uzdevumi
| Nosaukums |
Avots |
|
+ Technical Competence Requirements for CRA Notified Bodies
|
|
|
---+ 1. Introduction
|
|
|
------+ 1.1 Background
|
|
|
------+ 1.2 Scope
|
|
|
------+ 1.3 Relevant conformity assessment standards
|
|
|
---+ 2. Basic Concepts
|
|
|
------+ 2.1 Regulation
|
|
|
------+ 2.2 Roles
|
|
|
------+ 2.3 Competences, knowledge and skills
|
|
|
---+ 3. Required Knowledge and Skills
|
|
|
------+ 3.1 Overview
|
|
|
------+ 3.2 Competences for performing evaluations
|
|
|
---------+ 3.2.1 Knowledge of common industry practices
|
|
|
---------+ 3.2.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.2.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.2.4 Evaluation skills
|
|
|
---------+ 3.2.5 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.2.6 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.2.7 Knowledge of client’s business sector
|
|
|
---------+ 3.2.8 Knowledge of client products, processes and organisation
|
|
|
---------+ 3.2.9 Evaluation management skills
|
|
|
------+ 3.3 Competences for preparing evaluations
|
|
|
---------+ 3.3.1 Knowledge of common industry practices
|
|
|
---------+ 3.3.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.3.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.3.4 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.3.5 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.3.6 Knowledge of client’s business sector
|
|
|
---------+ 3.3.7 Knowledge of client products, processes and organisation
|
|
|
------+ 3.4 Competences for reviewing reports and making decisions
|
|
|
---------+ 3.4.1 Knowledge of common industry practices
|
|
|
---------+ 3.4.2 Knowledge of information security terminology, principles, practices and
|
|
|
---------+ 3.4.3 Knowledge of conformity assessment terminology, principles, practices and
|
|
|
---------+ 3.4.4 Knowledge of specific standards and normative documents
|
|
|
---------+ 3.4.5 Knowledge of conformity assessment body’s processes
|
|
|
---------+ 3.4.6 Knowledge of client’s business sector
|
|
|
---------+ 3.4.7 Knowledge of client’s products, processes and organisations
|
|
|
---+ 4. Competence requirements
|
|
|
------+ 4.1 Parameters
|
|
|
------+ 4.2 Input from EA’s Accreditation for Notification (AfN) Project
|
|
|
------+ 4.3 Management of competences
|
|