+13.2.3 The relevant entities shall test, review and, where appropriate, update the protection measures …

13.2.3 The relevant entities shall test, review and, where appropriate, update the protection measures …

Requirement

The relevant entities shall test, review and, where appropriate, update the protection measures against physical and environmental threats on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

  • Schedule and perform regular tests, such as quarterly fire drills and annual assessments of physical security measures.
    • Conduct both announced and unannounced tests

Examples of evidence

  • Detailed reports of the tests conducted, including objectives, procedures, results and any issues identified.
  • Minutes from review meetings detailing discussions, findings and decisions regarding protection measures.

Tips: guidance

  • Consider creating a topic-specific policy for protection against physical and environmental threats.
  • Deploy periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures
  • Consider implementing physically secure storage facilities for high-criticality assets of.

Tips: examples of evidence

  • Documented physical and environmental security policy, including a description of facilities and network and information systems in scope.
  • Results of periodic simulations and awareness raising activities.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos

Pedidos ligados

Ligações
is related to 13.2.3. As entidades pertinentes testam, analisam e, se for caso disso, atualizam as medidas de …
  • ENISA -

    EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

    DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.