7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

Requirement

For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures to assess whether the cybersecurity risk-management measures taken by the relevant entity are effectively implemented and maintained.

Guidance

• Take into account industry-recognised standards when developing the policy and procedures for assessing the efficient implementation of the measures (72).
• Implement a policy for assessing the effectiveness of implementation of measures that is proportionate to the risk posture of the entity in line with the risk assessment.

Examples of evidence

• Documented policy and procedures for effectiveness assessments based on good practices and standards (73).

Mapping to standards and frameworks

Requirement

The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine: (a) what cybersecurity risk-management measures are to be monitored and measured, including processes and controls; (b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results; (c) when the monitoring and measuring is to be performed; (d) who is responsible for monitoring and measuring the effectiveness of the cybersecurity risk-management measures; (e) when the results from monitoring and measurement are to be analysed and evaluated; (f) who has to analyse and evaluate these results.

Guidance

• When selecting measures for assessing effectiveness of implementation take into account the cost of their implementation.
• Consider one or more of the following indicative methods for assessing the effectiveness of implementation of a measure, according to the risk-treatment plan (section 2.1):
  • self-assessment,
  • benchmarking against a measure’s checklist or a standard,
  • vulnerability assessment,
  • penetration testing (e.g. internal, external, red/blue team),
  • secure code review,
  • audit (e.g. internal, external, compliance) and
  • performance monitoring.
• The assessment service can be provided by an external entity or by specially authorised employees of the entity.
  • In the case of external entities, confidentiality and non-disclosure terms should be included in the contract.
  • Internal employees should be suitably trained, based on the skills required for the objective of their role and the entity should consider their objectivity and impartiality, where possible. The entity should pay particular attention to the elements of point 2.3. of the Annex to the regulation concerning the impartiality of the employees. For instance, employees should not come from the department or division whose systems are being inspected and should not have been involved in developing the code or in installing or operating the system being audited for this purpose.
• Define key performance indicators (KPIs) to measure the effectiveness of measures including, one or more, notable examples such as (indicative, non-exhaustive list) (74):
  • the cost of implementation and maintenance, for example capital expenditure (CAPEX) / operational expenditure (OPEX);
  • the number of employees who have attended cybersecurity trainings (75);
  • the number of vulnerabilities detected;
  • time to remediation;
  • the number of incidents;
  • the number of incidents related to a change;
  • incident response times; and
  • number of non-compliances (consider the elements in point 2.2 of the Annex to the regulation concerning compliance monitoring).
• If possible, use the same KPIs for each assessment and utilize standardized templates and checklists to ensure consistency and thoroughness.
• Although the frequency of monitoring and measurement of measures, addressed in point 7.2.1 (a) of the Annex to the regulation, depends on the entity's risk assessment, the entity may follow this indicative, non-exhaustive guideline:
  • continuously monitor and measure the effectiveness of mitigating measures designed to address real-time threats (e.g. firewalls, IDS/IPS);
  • monitor and measure the effectiveness of security measures related to the threat landscape biannually (e.g. vulnerability management and incident response plans);
  • assess the overall effectiveness of all measures annually;
  • assess the effectiveness of measures related to a specific incident following that incident; and
  • assess the effectiveness of measures related to a specific system or one of its components following significant changes to this system or this component.

Examples of evidence

• Evidence that management has received reporting on the effective implementation of the measures.
• Evidence that monitoring and measurement results are reported to the management bodies (Annex to the regulation, point 2.3.3 concerning compliance monitoring).
• Documented objectives and KPIs for the implementation of the measures.
• Documented analysis and evaluation of the results from previous evaluations.
• Logs or records from previous effectiveness assessments.
• Plans or schedules for future effectiveness assessments.
• Documented roles and responsibilities.

Requirement

The relevant entities shall review and, where appropriate, update the policy and procedures at planned intervals and when significant incidents or significant changes to operations or risks.

Guidance

• Review policy and procedures for the assessment of the effectiveness of the measures at least every two years, taking into account:
  • changes to the information systems;
  • changes to the environment of operation; and
  • trends related to threats and vulnerabilities (take into account root cause analysis) (76).
• Update the policy and procedures based on findings from security tests (Annex to the regulation, point 6.5.2 (c) ) and the independent review of the policy on the security of the network and information systems (Annex to the regulation, point 2.3.3), if applicable.
• Take into account the results of the assessment and consider them when identifying and prioritising appropriate risk-treatment options and measures (Annex to the regulation, point 2.1.3).

Examples of evidence

• Logs or records from previous policy reviews.
• Plans or schedules for future effectiveness assessment reviews.
• Risk-treatment plan that takes into account the results of the effectiveness assessments.
• Minutes from meetings where security-testing results are discussed and the effectiveness of other policies is reviewed and improvements to them are discussed based on these results.
• Records showing updates to other policies and procedures with a view to assessing their effectiveness.