1.1.1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the …

(a)

set out the relevant entities’ approach to managing the security of their network and information systems;

(b)

be appropriate to and complementary with the relevant entities’ business strategy and objectives;

(c)

set out network and information security objectives;

(d)

include a commitment to continual improvement of the security of network and information systems;

(e)

include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies;

(f)

be communicated to and acknowledged by relevant employees and relevant interested external parties;

(g)

lay down roles and responsibilities pursuant to point 1.2;

(h)

list the documentation to be kept and the duration of retention of the documentation;

(i)

list the topic-specific policies;

(j)

lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security;

(k)

indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).