1.2.6 Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by …

Requirement

Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by management bodies at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Regularly review and revise the structure of security roles and responsibilities, based on (indicative, non-exhaustive list):
  • significant incidents, if any;
  • changes to the environment of operation, including changes to the network and information systems;
  • organisational changes.
• Where appropriate, updates should be approved by management bodies.

Examples of evidence

• Up-to-date documentation of the structure of security role assignments and responsibilities, including version history.
• Documentation of the review process, taking into account changes and past incidents.

Tips: guidance

• Make sure that the roles responsible for security roles are contactable in case of incidents.
• Make sure that each role has its deputy or that measures ensuring continuity in the event of the role representative’s absence are in place, where possible.
• Establish a clear reporting line from the designated security officer to senior management.
• Ensure that security reporting is integrated into the entity’s overall risk management framework.

Tips: examples of evidence

• Documented incident response procedures (Annex to the regulation, point 3.5.1) including clear procedures for contacting security roles during an incident.
• Logs and records of past incidents to check if the security roles were contacted promptly and effectively.
• Crisis management process and incident response records to check the involvement of the management.
• Up-to-date organisational chart to check if it clearly shows the reporting structure, including the designated security officer and their direct line to senior management. The organisational chart should be dated and the person making the update should be noted.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• ENISA -