2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …

Requirement

and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. Corrective actions shall be taken or residual risk accepted according to the relevant entities’ risk acceptance criteria.

Guidance

• Analyse and evaluate the results of the independent review.
• Report results to management bodies.
• Use a standardized report format for reporting to the management bodies. Consider the following elements (indicative, non-exhaustive list):
  • executive summary, including the scope and key findings,
  • methodology,
  • detailed findings, including gaps identified and non-compliance issues,
  • recommendations and
  • conclusions.
• Reports are generated and presented to management bodies at least annually.
• Take corrective actions or justify, accept and document residual risks.
• The outcomes of independent reviews should be systematically reflected in the risk assessment results and risk treatment plans (Annex to the regulation, point 2.1). Specifically, when a risk is identified or reassessed through an independent review, the corresponding risk assessment should be updated accordingly. This ensures that the risk profile remains accurate and that any emerging or evolving risks are adequately captured and addressed in the overall risk management framework.

Examples of evidence

• Documented analysis and evaluation of the results, including any residual risks.
• Minutes from past reviews.
• Any corrective actions resulting from the assessments and tests, including changes to the measures made by the entity once the effectiveness of the measures has been assessed in line with the Annex to the regulation, point 7.1.1.
• Documentation of any corrective actions.
• Budget approval for any corrective actions.
• The most recent results of compliance monitoring and auditing.
• Records from updated risk register.

Mapping to standards and frameworks

1. Pregled

1.1 Sklici

• GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
• ID.IM-01 Improvements are identified from evaluations
• ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
• ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
• ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -