1.2.2 The relevant entities shall require all personnel and third parties to apply network and …

Requirement

The relevant entities shall require all personnel and third parties to apply network and information system security in accordance with the established network and information security policy, topic-specific policies and procedures of the relevant entities.

Guidance

• Make personnel aware of the security roles in the entity and when each role should be contacted.
• Make personnel aware of their network and information system security obligations, according to their role. For the disciplinary process, see point 10.4 in the Annex to the regulation.
• Make relevant interested external parties aware of their network and information system security obligations.
  • For contractual requirements of direct suppliers and service providers, see point 5.1.4 in the Annex to the regulation.
  • Consider third parties, which means external entities or organisations not directly involved in the operations of the entity in scope but that may still affect its network and information security. For examples of relevant interested external parties, consider the guidance in section 1.1.
• The requirement that all personnel and third parties apply network and information system security should be communicated in a form that is relevant, accessible and understandable to the intended reader.
  • The network and information security policy, topic-specific policies and procedures of the relevant entities do not necessarily need to be communicated in their entirety.

Examples of evidence

• Awareness/dissemination material for personnel, explaining security roles and when/how they should be contacted.
• Service level agreements (SLAs), contracting contracts, data-processing agreements or other types of contracts or agreements with third parties.
• Acknowledgement from third parties in various forms (letters, emails, portals or other online options) confirming that they have received and understand their obligations related to network and information system security, where such requirements are not covered by contractual arrangements.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

3. Súvisiace predpisy

Prepojené úlohy

• ENISA -