3.3.1 The relevant entities shall put in place a simple mechanism allowing their employees, suppliers and …

Requirement

The relevant entities shall put in place a simple mechanism allowing their employees, suppliers and customers to report suspicious events.

Guidance

• Define what constitutes a suspicious event based on criteria (indicative, non-exhaustive list):
  • if the confidentiality or the integrity or the availability of the network or the information system has been affected;
  • persistence, meaning whether the event is ongoing or not;
  • impact, for example. the number of assets (potentially) affected; and
  • compliance violation of a regulation or the entity’s policies.
• Develop clear and concise guidelines for what information should be included in a report. Align this information with the information that might be submitted to the CSIRT or, where applicable to the competent authority, if the event is notified in accordance with the NIS2 Directive Articles 23 or 30. As good practice, the following should be reported as a minimum (indicative, non-exhaustive list):
  • date and time of the event,
  • description of the event,
  • any relevant screenshots, logs or other evidence,
  • contact information for follow-up if necessary.
• Provide multiple channels for reporting, such as email, a web form, a dedicated phone line or a mobile app. Ensure that these channels are easily accessible and intuitive to use.

Examples of evidence

• Documented mechanism that outlines the process for reporting security events.
• Examples of templates for reporting (29).
• Personnel aware of the mechanism and who to contact if they notice something suspicious.
• Existence of multiple reporting channels such as email addresses, web forms, phone numbers or dedicated reporting portals.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -