+ANNEX Technical and methodological requirements referred to in Article 2 of this Regulation
---+1. Policy on the security of network and information systems (Article 21(2), point (a) of Directive …
------+1.1. Policy on the security of network and information systems
---------+1.1.1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the …
---------+1.1.2. The network and information system security policy shall be reviewed and, where appropriate …
------+1.2. Roles, responsibilities and authorities
---------+1.2.1. As part of their policy on the security of network and information systems referred to in …
---------+1.2.2. The relevant entities shall require all personnel and third parties to apply network and …
---------+1.2.3. At least one person shall report directly to the management bodies on matters of network and …
---------+1.2.4. Depending on the size of the relevant entities, network and information system security …
---------+1.2.5. Conflicting duties and conflicting areas of responsibility shall be segregated, where …
---------+1.2.6. Roles, responsibilities and authorities shall be reviewed and, where appropriate, updated by …
---+2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)
------+2.1. Risk management framework
---------+2.1.1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the relevant …
---------+2.1.2. For the purpose of point 2.1.1, the relevant entities shall establish procedures for …
---------+2.1.3. When identifying and prioritising appropriate risk treatment options and measures, the …
---------+2.1.4. The relevant entities shall review and, where appropriate, update the risk assessment …
------+2.2. Compliance monitoring
---------+2.2.1. The relevant entities shall regularly review the compliance with their policies on network …
---------+2.2.2. The relevant entities shall put in place an effective compliance reporting system which …
---------+2.2.3. The relevant entities shall perform the compliance monitoring at planned intervals and when …
------+2.3. Independent review of information and network security
---------+2.3.1. The relevant entities shall review independently their approach to managing network and …
---------+2.3.2. The relevant entities shall develop and maintain processes to conduct independent reviews …
---------+2.3.3. The results of the independent reviews, including the results from the compliance monitoring …
---------+2.3.4. The independent reviews shall take place at planned intervals and when significant incidents …
---+3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
------+3.1. Incident handling policy
---------+3.1.1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant …
---------+3.1.2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and …
---------+3.1.3. The roles, responsibilities and procedures laid down in the policy shall be tested and …
------+3.2. Monitoring and logging
---------+3.2.1. The relevant entities shall lay down procedures and use tools to monitor and log activities …
---------+3.2.2. To the extent feasible, monitoring shall be automated and carried out either continuously or …
---------+3.2.3. Based on the procedures referred to in point 3.2.1, the relevant entities shall maintain …
---------+3.2.4. The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate …
---------+3.2.5. The relevant entities shall maintain and back up logs for a predefined period and shall …
---------+3.2.6. To the extent feasible, the relevant entities shall ensure that all systems have …
---------+3.2.7. The procedures as well as the list of assets that are being logged shall be reviewed and …
------+3.3. Event reporting
---------+3.3.1. The relevant entities shall put in place a simple mechanism allowing their employees …
---------+3.3.2. The relevant entities shall, where appropriate, communicate the event reporting mechanism to …
------+3.4. Event assessment and classification
---------+3.4.1. The relevant entities shall assess suspicious events to determine whether they constitute …
---------+3.4.2. For the purpose of point 3.4.1, the relevant entities shall act in the following manner: (a) …
------+3.5. Incident response
---------+3.5.1. The relevant entities shall respond to incidents in accordance with documented procedures …
---------+3.5.2. The incident response procedures shall include the following stages: (a) incident …
---------+3.5.3. The relevant entities shall establish communication plans and procedures: (a) with the …
---------+3.5.4. The relevant entities shall log incident response activities in accordance with the …
---------+3.5.5. The relevant entities shall test at planned intervals their incident response procedures.
------+3.6. Post-incident reviews
---------+3.6.1. Where appropriate, the relevant entities shall carry out post-incident reviews after …
---------+3.6.2. The relevant entities shall ensure that post-incident reviews contribute to improving their …
---------+3.6.3. The relevant entities shall review at planned intervals if incidents led to post-incident …
---+4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)
------+4.1. Business continuity and disaster recovery plan
---------+4.1.1. For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant …
---------+4.1.2. The relevant entities’ operations shall be restored according to the business continuity and …
---------+4.1.3. The relevant entities shall carry out a business impact analysis to assess the potential …
---------+4.1.4. The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …
------+4.2. Backup and redundancy management
---------+4.2.1. The relevant entities shall maintain backup copies of data and provide sufficient available …
---------+4.2.2. Based on the results of the risk assessment carried out pursuant to point 2.1 and the …
---------+4.2.3. The relevant entities shall perform regular integrity checks on the backup copies.
---------+4.2.4. Based on the results of the risk assessment carried out pursuant to point 2.1 and the …
---------+4.2.5. Where appropriate, the relevant entities shall ensure that monitoring and adjustment of …
---------+4.2.6. The relevant entities shall carry out regular testing of the recovery of backup copies and …
------+4.3. Crisis management
---------+4.3.1. The relevant entities shall put in place a process for crisis management.
---------+4.3.2. The relevant entities shall ensure that the crisis management process addresses at least the …
---------+4.3.3. The relevant entities shall implement a process for managing and making use of information …
---------+4.3.4. The relevant entities shall test, review and, where appropriate, update the crisis …
---+5. Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)
------+5.1. Supply chain security policy
---------+5.1.1. For the purpose of Article 21(2), point (d) of Directive (EU) 2022/2555, the relevant …
---------+5.1.2. As part of the supply chain security policy referred to in point 5.1.1, the relevant …
---------+5.1.3. When establishing their supply chain security policy, relevant entities shall take into …
---------+5.1.4. Based on the supply chain security policy and taking into account the results of the risk …
---------+5.1.5. The relevant entities shall take into account the elements referred to in point 5.1.2 and …
---------+5.1.6. The relevant entities shall review the supply chain security policy, and monitor, evaluate …
---------+5.1.7. For the purpose of point 5.1.6, the relevant entities shall: (a) regularly monitor reports …
------+5.2. Directory of suppliers and service providers
---+6. Security in network and information systems acquisition, development and maintenance (Article …
------+6.1. Security in acquisition of ICT services or ICT products
---------+6.1.1. For the purpose of Article 21(2), point (e) of Directive (EU) 2022/2555, the relevant …
---------+6.1.2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include: (a) …
---------+6.1.3. The relevant entities shall review and, where appropriate, update the processes at planned …
------+6.2. Secure development life cycle
---------+6.2.1. Before developing a network and information system, including software, the relevant …
---------+6.2.2. For the purpose of point 6.2.1, the relevant entities shall: (a) carry out an analysis of …
---------+6.2.3. For outsourced development of network and information systems, the relevant entities shall …
---------+6.2.4. The relevant entities shall review and, where necessary, update their secure development …
------+6.3. Configuration management
---------+6.3.1. The relevant entities shall take the appropriate measures to establish, document, implement …
---------+6.3.2. For the purpose of point 6.3.1, the relevant entities shall: (a) lay down and ensure …
---------+6.3.3. The relevant entities shall review and, where appropriate, update configurations at planned …
------+6.4. Change management, repairs and maintenance
---------+6.4.1. The relevant entities shall apply change management procedures to control changes of network …
---------+6.4.2. The procedures referred to in point 6.4.1 shall be applied for releases, modifications and …
---------+6.4.3. In the event that the regular change management procedures could not be followed due to an …
---------+6.4.4. The relevant entities shall review and, where appropriate, update the procedures at planned …
------+6.5. Security testing
---------+6.5.1. The relevant entities shall establish, implement and apply a policy and procedures for …
---------+6.5.2. The relevant entities shall: (a) establish, based on the risk assessment carried out …
---------+6.5.3. The relevant entities shall review and, where appropriate, update their security testing …
------+6.6. Security patch management
---------+6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
---------+6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
------+6.7. Network security
---------+6.7.1. The relevant entities shall take the appropriate measures to protect their network and …
---------+6.7.2. For the purpose of point 6.7.1, the relevant entities shall: (a) document the architecture …
---------+6.7.3. The relevant entities shall review and, where appropriate, update these measures at planned …
------+6.8. Network segmentation
---------+6.8.1. The relevant entities shall segment systems into networks or zones in accordance with the …
---------+6.8.2. For that purpose, the relevant entities shall: (a) consider the functional, logical and …
---------+6.8.3. The relevant entities shall review and, where appropriate, update network segmentation at …
------+6.9. Protection against malicious and unauthorised software
---------+6.9.1. The relevant entities shall protect their network and information systems against malicious …
---------+6.9.2. For that purpose, the relevant entities shall in particular implement measures that detect …
------+6.10. Vulnerability handling and disclosure
---------+6.10.1. The relevant entities shall obtain information about technical vulnerabilities in their …
---------+6.10.2. For the purpose of point 6.10.1, the relevant entities shall: (a) monitor information about …
---------+6.10.3. When justified by the potential impact of the vulnerability, the relevant entities shall …
---------+6.10.4. The relevant entities shall review and, where appropriate, update at planned intervals the …
---+7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures …
------+7.1. For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
------+7.2. The policy and procedures referred to in point 7.1 shall take into account results of the risk …
------+7.3. The relevant entities shall review and, where appropriate, update the policy and procedures at …
---+8. Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) …
------+8.1. Awareness raising and basic cyber hygiene practices
---------+8.1.1. For the purpose of Article 21(2), point (g) of Directive (EU) 2022/2555, the relevant …
---------+8.1.2. For the purpose of point 8.1.1, the relevant entities shall offer to their employees …
---------+8.1.3. The awareness raising programme shall, where appropriate, be tested in terms of …
------+8.2. Security training
---------+8.2.1. The relevant entities shall identify employees, whose roles require security relevant skill …
---------+8.2.2. The relevant entities shall establish, implement and apply a training program in line with …
---------+8.2.3. The training referred to in point 8.2.1 shall be relevant to the job function of the …
---------+8.2.4. The relevant entities shall apply training to staff members who transfer to new positions or …
---------+8.2.5. The program shall be updated and run periodically taking into account applicable policies …
---+9. Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)
------+9.1. For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
------+9.2. The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the …
------+9.3. The relevant entities shall review and, where appropriate, update their policy and procedures …
---+10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)
------+10.1. Human resources security
---------+10.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+10.1.2. The requirement referred to in point 10.1.1 shall include the following: (a) mechanisms to …
---------+10.1.3. The relevant entities shall review the assignment of personnel to specific roles as …
------+10.2. Verification of background
---------+10.2.1. The relevant entities shall ensure to the extent feasible verification of the background of …
---------+10.2.2. For the purpose of point 10.2.1, the relevant entities shall: (a) put in place criteria …
---------+10.2.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+10.3. Termination or change of employment procedures
---------+10.3.1. The relevant entities shall ensure that network and information system security …
---------+10.3.2. For the purpose of point 10.3.1, the relevant entities shall include in the individual’s …
------+10.4. Disciplinary process
---------+10.4.1. The relevant entities shall establish, communicate and maintain a disciplinary process for …
---------+10.4.2. The relevant entities shall review and, where appropriate, update the disciplinary process …
---+11. Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)
------+11.1. Access control policy
---------+11.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+11.1.2. The policies referred to in point 11.1.1. shall: (a) address access by persons, including …
---------+11.1.3. The relevant entities shall review and, where appropriate, update the policies at planned …
------+11.2. Management of access rights
---------+11.2.1. The relevant entities shall provide, modify, remove and document access rights to network …
---------+11.2.2. The relevant entities shall: (a) assign and revoke access rights based on the principles of …
---------+11.2.3. The relevant entities shall review access rights at planned intervals and shall modify them …
------+11.3. Privileged accounts and system administration accounts
---------+11.3.1. The relevant entities shall maintain policies for management of privileged accounts and …
---------+11.3.2. The policies referred to in point 11.3.1 shall: (a) establish strong identification …
---------+11.3.3. The relevant entities shall review access rights of privileged accounts and system …
------+11.4. Administration systems
---------+11.4.1. The relevant entities shall restrict and control the use of system administration systems …
---------+11.4.2. For that purpose, the relevant entities shall: (a) only use system administration systems …
------+11.5. Identification
---------+11.5.1. The relevant entities shall manage the full life cycle of identities of network and …
---------+11.5.2. For that purpose, the relevant entities shall: (a) set up unique identities for network and …
---------+11.5.3. The relevant entities shall only permit identities assigned to multiple persons, such as …
---------+11.5.4. The relevant entities shall regularly review the identities for network and information …
------+11.6. Authentication
---------+11.6.1. The relevant entities shall implement secure authentication procedures and technologies …
---------+11.6.2. For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …
---------+11.6.3. The relevant entities shall to the extent feasible use state-of-the-art authentication …
---------+11.6.4. The relevant entities shall review the authentication procedures and technologies at …
------+11.7. Multi-factor authentication
---------+11.7.1. The relevant entities shall ensure that users are authenticated by multiple authentication …
---------+11.7.2. The relevant entities shall ensure that the strength of authentication is appropriate for …
---+12. Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)
------+12.1. Asset classification
---------+12.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant …
---------+12.1.2. For the purpose of point 12.1.1, the relevant entities shall: (a) lay down a system of …
---------+12.1.3. The relevant entities shall conduct periodic reviews of the classification levels of assets …
------+12.2. Handling of assets
---------+12.2.1. The relevant entities shall establish, implement and apply a policy for the proper handling …
---------+12.2.2. The policy shall: (a) cover the entire life cycle of the assets, including acquisition …
---------+12.2.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+12.3. Removable media policy
---------+12.3.1. The relevant entities shall establish, implement and apply a policy on the management of …
---------+12.3.2. The policy shall: (a) provide for a technical prohibition of the connection of removable …
---------+12.3.3. The relevant entities shall review and, where appropriate, update the policy at planned …
------+12.4. Asset inventory
---------+12.4.1. The relevant entities shall develop and maintain a complete, accurate, up-to-date and …
---------+12.4.2. The granularity of the inventory of the assets shall be at a level appropriate for the …
---------+12.4.3. The relevant entities shall regularly review and update the inventory and their assets and …
------+12.5. Deposit, return or deletion of assets upon termination of employment
---+13. Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) …
------+13.1. Supporting utilities
---------+13.1.1. For the purpose of Article 21(2)(c) of Directive (EU) 2022/2555, the relevant entities …
---------+13.1.2. For that purpose, the relevant entities shall, where appropriate: (a) protect facilities …
---------+13.1.3. The relevant entities shall test, review and, where appropriate, update the protection …
------+13.2. Protection against physical and environmental threats
---------+13.2.1. For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities …
---------+13.2.2. For that purpose, the relevant entities shall, where appropriate: (a) design and implement …
---------+13.2.3. The relevant entities shall test, review and, where appropriate, update the protection …
------+13.3. Perimeter and physical access control
---------+13.3.1. For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities …
---------+13.3.2. For that purpose, the relevant entities shall: (a) on the basis of the risk assessment …
---------+13.3.3. The relevant entities shall test, review and, where appropriate, update the physical access …
|
ANNEX Technical and methodological requirements referred to in Article 2 of this Regulation
ANNEX Technical and methodological requirements referred to in Article 2 of this Regulation
1. Översikt
| Rubrik |
Reglering |
|
1. Policy on the security of network and information systems (Article 21(2), point (a) of Directive …
|
1. Policy on the security of network and information systems (Article 21(2), point (a) of Directive (EU) 2022/2555)
|
|
2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)
|
2. Risk management policy (Article 21(2), point (a) of Directive (EU) 2022/2555)
|
|
3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
|
3. Incident handling (Article 21(2), point (b), of Directive (EU) 2022/2555)
|
|
4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)
|
4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)
|
|
5. Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)
|
5. Supply chain security (Article 21(2), point (d), of Directive (EU) 2022/2555)
|
|
6. Security in network and information systems acquisition, development and maintenance (Article …
|
6. Security in network and information systems acquisition, development and maintenance (Article 21(2), point (e), of Directive (EU) 2022/2555)
|
|
7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures …
|
7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures (Article 21(2), point (f), of Directive (EU) 2022/2555)
|
|
8. Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) …
|
8. Basic cyber hygiene practices and security training (Article 21(2), point (g), of Directive (EU) 2022/2555)
|
|
9. Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)
|
9. Cryptography (Article 21(2), point (h), of Directive (EU) 2022/2555)
|
|
10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)
|
10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)
|
|
11. Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)
|
11. Access control (Article 21(2), points (i) and (j), of Directive (EU) 2022/2555)
|
|
12. Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)
|
12. Asset management (Article 21(2), point (i), of Directive (EU) 2022/2555)
|
|
13. Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) …
|
13. Environmental and physical security (Article 21(2), points (c), (e) and (i) of Directive (EU) 2022/2555)
|
,
1.1 Referenser
1.2 Identifierade krav
1.3 Relaterade standarder
2. Identifierade krav
3. Relaterade standarder
|