4.3.3 The relevant entities shall implement a process for managing and making use of information received …

Requirement

The relevant entities shall implement a process for managing and making use of information received from the CSIRTs or, where applicable, the competent authorities, concerning incidents, vulnerabilities, threats or possible mitigation measures.

Guidance

• Implement a process for managing and making use of information received from the CSIRTs. Consider the following steps (indicative, non-exhaustive list):
  • designate a point of contact with the CSIRT;
  • ensure that the point of contact has sufficient knowledge concerning incidents and threat intelligence.
  • classify incoming information into categories such as incidents, vulnerabilities, threats and mitigation measures.
  • assign priority levels based on severity and potential impact on the entity, if the information is relevant or applicable
  • have the CSIRT contact point review the information for relevance and urgency.
  • validate information against internal logs, threat intelligence feeds and existing security policies.
  • for vulnerabilities and threats, if applicable, collaborate with relevant teams (IT, security, operations) to develop a mitigation strategy;
  • update or create incident response plans based on the nature of the threats or incidents reported in accordance with point 3.5 of the Annex to the regulation.
  • where appropriate, implement the mitigation measures and communicate with the relevant stakeholders in accordance with point 3.5 of the Annex to the regulation.
  • share insights and feedback on incidents and mitigations with the CSIRT on a voluntary basis.

Examples of evidence

• Previous communications with CSIRTs or, where applicable, the competent authorities, for example emails, correspondence and meeting minutes.
• Evidences that the point of contact has sufficient knowledge concerning incidents and threat intelligence.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.