4.2.4 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …

Requirement

Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall ensure sufficient availability of resources by at least partial redundancy of the following: (a) network and information systems; (b) assets, including facilities, equipment and supplies; (c) personnel with the necessary responsibility, authority and competence; (d) appropriate communication channels.

Guidance

• Define minimum resources needed to ensure at least partial redundancy for each of points (a), (b), (c) and (d). These may include the following:
  • network and information systems: one or more of the following (indicative, non-exhaustive list):
    • multiple internet service providers,
    • load balancing,
    • mirrored servers,
    • virtualisation,
    • redundant array of independent disks;
  • assets: one or more of the following (indicative, non-exhaustive list):
    • shared workspaces,
    • backup locations,
    • spare equipment,
    • multiple suppliers for the same categories of products;
  • personnel: one or more of the following (indicative, non-exhaustive list):
    • job rotation,
    • backup assignments,
    • emergency drills;
  • multiple communication platforms, for example social media, messaging apps and email; and
  • multiple methods to power a site, either through multiple electrical providers or with a combination of electrical providers and backup mechanisms, such as generators.

Examples of evidence

• One or more of the above mechanisms are in place.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -