2.1.3 When identifying and prioritising appropriate risk treatment options and measures, the relevant …

Requirement

When identifying and prioritising appropriate risk treatment options and measures, the relevant entities shall take into account the risk assessment results, the results of the procedure to assess the effectiveness of cybersecurity risk-management measures, the cost of implementation in relation to the expected benefit, the asset classification referred to in point 12.1 and the business impact analysis referred to in point 4.1.3.

Guidance

• Make sure that personnel take into account the elements referred to in point 2.1.3 of the Annex to the regulation.

Examples of evidence

• Guidance for personnel on assessing risks that takes into account the elements referred to in point 2.1.3 of the Annex to the regulation.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• ENISA -