2.2.2 The relevant entities shall put in place an effective compliance reporting system which shall be …

Requirement

The relevant entities shall put in place an effective compliance reporting system which shall be appropriate to their structures, operating environments and threat landscapes. The compliance reporting system shall be capable to provide to the management bodies an informed view of the current state of the relevant entities’ management of risks.

Guidance

• Set up procedures for compliance monitoring, including (indicative, non-exhaustive list):
  • objectives and a high-level approach to compliance monitoring;
  • relevant security policies that are subject to compliance monitoring;
  • the frequency of compliance reviews;
  • who should carry out compliance reviews (internal or external); and
  • templates for compliance review reports.
• Analyse and evaluate the results of the compliance review.

Examples of evidence

• Documented procedures for monitoring compliance.
• Documented analysis and evaluation of the results, including the current state of the entity’s risk management.
• Detailed compliance monitoring plans, including long-term, high-level objectives and planning.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

3. Regolamenti relatati

Kwistjonijiet marbuta

• ENISA -