6.5.3 The relevant entities shall review and, where appropriate, update their security testing policies …

Requirement

The relevant entities shall review and, where appropriate, update their security testing policies at planned intervals.

Guidance

• Review the security testing policy and procedures at least once every two years.

Examples of evidence

• Updated security-testing policy and procedures, review comments, and/or change logs.
• Security-testing policy and procedures, including when tests must be carried out, test plans, test cases and test report templates.

Tips: guidance

• For systems with external integrations (e.g. cloud services) beyond the organization’s control, ensure that all external application programming interface endpoints are thoroughly tested.
• Determine the auditable security events that are adequate for supporting investigations of security incidents.
• Implement tools for automated testing, such as code analysis tools or vulnerability scanners.
• Ensure the policy is approved by, communicated to and acknowledged by relevant personnel and third parties.
• Ensure that the development and testing environment(s) is/are separate from the production environment.
• Review the security-testing policy and procedures when significant incidents or major changes to the network and information system occur.

Tips: examples of evidence

• In addition to the elements referred to in point 6.5.2 (c) of the Annex to the regulation, documented policy that includes at least (indicative, non-exhaustive list):
  • approved parties (internal or third);
  • confidentiality levels for assessment; and
  • test results and the objectives of security assessments and tests.
• Relevant staff aware of the security-testing procedures and tools.
• Documented audit requirements.
• A list of tools used for security testing, including their purpose and how they are maintained and updated.
• Valid licences for commercial testing tools or subscriptions to security services.
• Review showing that the security tools are in use and configured to perform the actions intended.
• Records showing updates to the security policy and procedures based on lessons learnt and new threats.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• ENISA -