2.2.1 The relevant entities shall regularly review the compliance with their policies on network and …

Requirement

The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.

Guidance

• Develop a standardized report format for reporting to management bodies. Consider the following elements (indicative, non-exhaustive list):
  • key metrics,
  • compliance status, including policy exceptions,
  • identified risks and
  • recommended actions.
• Reports are generated and presented to management bodies at least annually.

Examples of evidence

• Recent compliance review reports.
• Logs of policy exceptions. Examples of such exceptions include, among others, the situations mentioned in the second paragraph of Article 2(2) and those under recital 5 of the regulation. Other examples include (indicative, non-exhaustive list):
  • software updates: if a system relies on an older version of software that is incompatible with the latest update, an exception might be granted to delay the update until a compatible solution is found;
  • access control: if a particular user or system cannot support an authentication mechanism (e.g. multi-factor authentication (MFA)) due to technical limitations, an exception might be granted while alternative measures are implemented; and
  • encryption: if a legacy system does not support encryption, an exception might be granted until the system is replaced.
• Records of the exception request and approval, along with details of the compensatory controls implemented.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

3. Súvisiace predpisy

Prepojené úlohy

• ENISA -