The organization must prepare, maintain, and proactively submit an annual security report summarizing all relevant security activities and incident data for each calendar year. The report must be signed by the cybersecurity officer and submitted to the competent cybersecurity authority in accordance with the defined schedule.
The annual security report should provide a clear overview of the organization’s security posture and incident trends, including at minimum:
- A summary of major actions and initiatives related to network and information system security;
- Quarterly statistics on incidents, broken down by type and frequency;
- An overview of significant incidents, outlining their impact on users, duration, and affected regions (including any cross-border effects);
- Key lessons learned and measures taken to prevent recurrence;
- Recommendations to enhance the organization’s security practices;
- Any other information considered relevant to improving cybersecurity management.
The annual security report must be submitted each year by the last working day of January.
Additionally, a procedure must be in place to handle official requests for information from the CNCS. This includes:
- Validating the authenticity of each request received from the CNCS;
- Assigning clear responsibility for preparing and submitting the annual security report or other requested information;
- Ensuring that the submission is completed within the specified timeframe and through the official channels designated in the request.
.svg)
