CyberFundamentals

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

Assessment of the impact and likelihood of the risks and the scales used

Critical

High

Normal

Low

Cyber security management

ID.RA-6: Risk responses are identified and prioritized.

A comprehensive strategy shall be developed and implemented to manage risks to the organization’s critical systems, that includes the identification and prioritization of risk responses.
Guidance
- Management and employees should be involved in information- and cybersecurity.
- It should be identified what the most important assets are, and how they are protected.
- It should be clear what impact will be if these assets are compromised.
- It should be established how the implementation of adequate mitigation measures will be organized.

Related tasks

Amount, competence and adequacy of key cyber security personnel

Critical

High

Normal

Low

Identification and documentation of cyber security risks

Critical

High

Normal

Low

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

ID.RM-1: Risk management processes are established, managed, and agreed to by organizational stakeholders.

A cyber risk management process that identifies key internal and external stakeholders andfacilitates addressing risk-related issues and information shall be created, documented, reviewed, approved, and updated when changes occur.
Guidance
External stakeholders include customers, investors and shareholders, suppliers, government agencies and the wider community.

Related tasks

Approval of the risk management procedure description

Critical

High

Normal

Low

ID.RM-2: Organizational risk tolerance is determined and clearly expressed.

The organization shall clearly determine its risk appetite.
Guidance
Determination and expression of risk tolerance (risk appetite) should be in line with the policies on information security and cybersecurity, to facilitate demonstration of coherence between policies, risk tolerance and measures.

Related tasks

Risk level accepted by the organization

Critical

High

Normal

Low

ID.RM-3: The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis.

The organization’s role in critical infrastructure and its sector shall determine the organization’s risk appetite.

Related tasks

Identification and documentation of cyber security risks

Critical

High

Normal

Low

Risk level accepted by the organization

Critical

High

Normal

Low

ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders.

The organization shall document, review, approve, update when changes occur, and implement a cyber supply chain risk management process that supports the identification, assessment, and mitigation of the risks associated with the distributed and interconnected nature of ICT/OT product and service supply chains.

Related tasks

Documentation of other stakeholders

Critical

High

Normal

Low

Supply chain cyber security risk management

Critical

High

Normal

Low

Supplier security

ID.SC-2: Suppliers and third-party partners of information systems, components, and services are identified, prioritized, and assessed using a cyber supply chain risk assessment process.

The organization shall conduct cyber supply chain risk assessments at least annually or when a change to the organization’s critical systems, operational environment, or supply chain occurs; These assessments shall be documented, and the results disseminated to relevant stakeholders including those responsible for ICT/OT systems.
Guidance
This assessment should identify and prioritize potential negative impacts to the organization from the risks associated with the distributed and interconnected nature of ICT/OT product and service supply chains.

A documented list of all the organization’s suppliers, vendors and partners who may be involved in a major incident shall be established, kept up-to-date and made available online and offline.
Guidance
This list should include suppliers, vendors and partners contact information and the services they provide,so they can be contacted for assistance in the event of an outage or service degradation.

Related tasks

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Prioritization of partners based on criticality

Critical

High

Normal

Low

Supplier security

ID.SC-3: Contracts with suppliers and third-party partners are used to implement appropriate measures designed to meet the objectives of an organization’s cybersecurity program and Cyber Supply Chain Risk Management Plan.

Based on the results of the cyber supply chain risk assessment, a contractual framework for suppliers and external partners shall be established to address sharing of sensitive information and distributed and interconnected ICT/OT products and services.
Guidance
- Entities not subject to the NIS legislation should consider business critical suppliers and third-party partners only.
- Keep in mind that GDPR requirements need to be fulfilled when business information contains personal data (applicable on all levels), i.e. security measures need to be addressed in the contractual framework.

Contractual ‘information security and cybersecurity’ requirements for suppliers and thirdparty partners shall be implemented to ensure a verifiable flaw remediation process, and to ensure the correction of flaws identified during ‘information security and cybersecurity’ testing and evaluation.
Guidance
- Information systems containing software (or firmware) affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) should be identified.
- Newly released security relevant patches, service packs, and hot fixes should be installed, and these patches, service packs, and hot fixes are tested for effectiveness and potential side effects on the organization’s information systems before installation. Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling are also addressed expeditiously. Flaw remediation should be incorporated into configuration management as an emergency change.

The organization shall establish contractual requirements permitting the organization to review the ‘information security and cybersecurity’ programs implemented by suppliers and third-party partners.

Related tasks

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Regular security assessment of partners in the supply chain of provided digital services

Critical

High

Normal

Low

Cloud service management

ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations.

The organization shall review assessments of suppliers’ and third-party partner’s compliance with contractual obligations by routinely reviewing audits, test results, and other evaluations.
Guidance
Entities not subject to the NIS legislation could limit themselves to business-critical suppliers and thirdparty partners only.

The organization shall review assessments of suppliers’ and third-party partner’s compliance with contractual obligations by routinely reviewing third-party independent audits, test results, and other evaluations.
Guidance
The depth of the review should depend on the criticality of delivered products and services.

Related tasks

Criteria for suppliers of high priority data systems

Critical

High

Normal

Low

Data system procurement

Monitoring suppliers' compliance with security requirements

Critical

High

Normal

Low

Definition of supplier-specific responsible persons

Critical

High

Normal

Low

Criteria for high priority partners

Critical

High

Normal

Low

Supplier security

Regular security assessment of partners in the supply chain of provided digital services

Critical

High

Normal

Low

Cloud service management

ID.SC-5: Response and recovery planning and testing are conducted with suppliers and third-party providers.

The organization shall identify and document key personnel from suppliers and third-party partners to include them as stakeholders in response and recovery planning activities.
Guidance
Entities not subject to the NIS legislation could limit themselves to business-critical suppliers and thirdparty partners only.

The organization shall identify and document key personnel from suppliers and third-party partners to include them as stakeholders in testing and execution of the response and recovery plans.

Related tasks

Creating and documenting continuity plans

Critical

High

Normal

Low

Continuity management

Regular testing and review of continuity plans

Critical

High

Normal

Low

Continuity management