Content library
Cyber security management
Appointing a qualified cybersecurity auditor (Malta)
Risk management and leadership
Cyber security management

Appointing a qualified cybersecurity auditor (Malta)

Start free trial

Task description

Appointing a qualified cybersecurity auditor (Malta)

The organization shall appoint a qualified auditor for the verification of its cybersecurity risk management measures. The auditor shall meet the necessary qualification requirements as defined by the relevant regulations.

To be considered qualified, the auditor must provide documented evidence of one or more of the following:

  • possession of documentation confirming a background verification issued by the competent authority in accordance with Directive (EU) 2022/2557;
  • possession of a valid European and/or international cybersecurity certification or standard;
  • demonstrated experience and skill set as defined by the CIP Department.

    • For essential entities, the auditor must meet all three requirements.

    The organization shall ensure that the auditor's appointment is approved by the CIP Department or, where applicable, the designated competent authority. The appointment can only be made after the auditor has submitted a motivated request and supporting documents to the approving authority and official approval has been granted.

    The audit shall confirm that the organization's cybersecurity risk management measures comply with the applicable legal, regulatory, and technical standards.

    Requirements connected to the task

    14.1: Ħatra u approvazzjoni ta’ awditur kwalifikat għall-verifika ta’ miżuri taċ-ċibersigurtà
    Avviż Legali 71 tal-2025 (Malta)

    Other tasks from the same security theme

    Task name
    Priority
    Policy
    Other requirements
    Creation and maintenance of the information security plan report
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    3: Vastuut tietoturvan sekä asiakastietojen asianmukaisen käsittelyn varmistamisessa
    Tietoturvasuunnitelma
    See all related requirements and other information from tasks own page.
    Go to >
    Creation and maintenance of the information security plan report
    Information security policy -report publishing, informing and maintenance
    Critical
    High
    Normal
    Low
    Cyber security management
    59
    requirements

    Examples of other requirements this task affects

    Članak 29.a: Upravljanje
    NIS2 Croatia
    10 §: Johdon vastuu
    Kyberturvallisuuslaki
    9.2 §: Kyberturvallisuuden toimintaperiaatteet
    Kyberturvallisuuslaki
    1.1.1: Availability of information security policies
    TISAX
    31 § 1°: Approbation des mesures de gestion des risques de cybersécurité
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Information security policy -report publishing, informing and maintenance
    Defining and documenting security objectives
    Critical
    High
    Normal
    Low
    Cyber security management
    41
    requirements

    Examples of other requirements this task affects

    Članak 29.a: Upravljanje
    NIS2 Croatia
    10 §: Johdon vastuu
    Kyberturvallisuuslaki
    9.2 §: Kyberturvallisuuden toimintaperiaatteet
    Kyberturvallisuuslaki
    31 § 1°: Approbation des mesures de gestion des risques de cybersécurité
    NIS2 Belgium
    ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated.
    CyberFundamentals
    See all related requirements and other information from tasks own page.
    Go to >
    Defining and documenting security objectives
    Executing and documenting internal audits
    Critical
    High
    Normal
    Low
    Cyber security management
    52
    requirements

    Examples of other requirements this task affects

    Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
    NIS2 Croatia
    Članak 35: Provedba samoprocjene kibernetičke sigurnosti
    NIS2 Croatia
    9.1 §: Toimien vaikuttavuuden arviointi
    Kyberturvallisuuslaki
    1.5.1: Assessment of policies and requirements
    TISAX
    39: Conformité et audits
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Executing and documenting internal audits
    Creating and maintaining a statement of applicability
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    6.1: Information security risk management
    ISO 27001
    7.5: Requirements for documented information
    ISO 27001
    1.2.1: Scope of Information Security management
    TISAX
    See all related requirements and other information from tasks own page.
    Go to >
    Creating and maintaining a statement of applicability
    Identification, documentation and management of other information security requirements
    Critical
    High
    Normal
    Low
    Cyber security management
    24
    requirements

    Examples of other requirements this task affects

    7.1.1: Compliance management
    TISAX
    30 § 2°: Évaluation des risques et mesures de gestion
    NIS2 Belgium
    1.1.1: Identify the organisation’s strategy and priorities
    NSM ICT-SP
    DE.DP-2: Detection activities comply with all applicable requirements.
    CyberFundamentals
    ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood, and managed.
    CyberFundamentals
    See all related requirements and other information from tasks own page.
    Go to >
    Identification, documentation and management of other information security requirements
    Internal audit procedure -report publishing and maintenance
    Critical
    High
    Normal
    Low
    Cyber security management
    23
    requirements

    Examples of other requirements this task affects

    ID.GV-3: Legal and regulatory requirements
    NIST
    14.6.: Vadovybės atsakomybė
    NIS2 Lithuania
    7.5: Requirements for documented information
    ISO 27001
    9.2: Internal audit
    ISO 27001
    CC1.5: Accountability for responsibilities
    SOC 2
    See all related requirements and other information from tasks own page.
    Go to >
    Internal audit procedure -report publishing and maintenance
    ISMS description and maintenance
    Critical
    High
    Normal
    Low
    Cyber security management
    36
    requirements

    Examples of other requirements this task affects

    2.1: Tietoturvallisuusvastuiden määrittely
    TiHL tietoturvavaatimukset
    2.3: Tietoturvallisuus tiedonhallintamallissa
    TiHL tietoturvavaatimukset
    1.2.1: Scope of Information Security management
    TISAX
    PR.AT-5: Physical security and cybersecurity personnel understand their roles and responsibilities.
    CyberFundamentals
    PR.AT-5: Physical and cybersecurity personnel
    NIST
    See all related requirements and other information from tasks own page.
    Go to >
    ISMS description and maintenance
    Defining the frameworks that serve as the basis of the management system
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    CC3.1: Sufficient specifying of objectives
    SOC 2
    See all related requirements and other information from tasks own page.
    Go to >
    Defining the frameworks that serve as the basis of the management system
    Regular review of the cyber security risk documentation
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 13.7: Documenting cybersecurity
    CRA
    See all related requirements and other information from tasks own page.
    Go to >
    Regular review of the cyber security risk documentation
    Documentation of risk assessment
    Critical
    High
    Normal
    Low
    Cyber security management
    5
    requirements

    Examples of other requirements this task affects

    Article 13.3: Documenting risk assessment
    CRA
    11.7: Listei de active și riscuri
    NIS2 Romania
    12.2: Risk assessment measures
    CER
    § 4-4: Krav til dokumentasjon
    Sikkerhetsloven
    See all related requirements and other information from tasks own page.
    Go to >
    Documentation of risk assessment
    Provision of product information to the market surveillance authority
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 13.22: Conformity
    CRA
    See all related requirements and other information from tasks own page.
    Go to >
    Provision of product information to the market surveillance authority
    Single point of contact for reporting vulnerabilities
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 13.17: Single point of contact
    CRA
    See all related requirements and other information from tasks own page.
    Go to >
    Single point of contact for reporting vulnerabilities
    Maintaining a coordinated vulnerability disclosure policy and reporting procedure
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Vuln.5: Coordinated vulnerability disclosure
    CRA
    See all related requirements and other information from tasks own page.
    Go to >
    Maintaining a coordinated vulnerability disclosure policy and reporting procedure
    Cybersecurity requirements related to the use of AI
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 12.1: High risk AI
    CRA
    See all related requirements and other information from tasks own page.
    Go to >
    Cybersecurity requirements related to the use of AI
    Integration of change management procedures
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Integration of change management procedures
    Disciplinary process for non-conformance
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Disciplinary process for non-conformance
    Cyber security policy and procedure compliance requirements
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Cyber security policy and procedure compliance requirements
    Security related policies and procedures for all assets
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    Art. 13.2.1: Mesures permanentes de sécurité intérieure
    Loi infrastructures critiques
    See all related requirements and other information from tasks own page.
    Go to >
    Security related policies and procedures for all assets
    Defining triggers for evaluating the information security management system
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Defining triggers for evaluating the information security management system
    Review of information security management system best practices
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    § 6.1: Sikkerhetsstyringssystem
    NIS2 NO
    See all related requirements and other information from tasks own page.
    Go to >
    Review of information security management system best practices
    Defining system auditing roles and responsibilities
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Defining system auditing roles and responsibilities
    Reviewing security policies and procedures
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Reviewing security policies and procedures
    Conducting business impact analysis
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Conducting business impact analysis
    Creating and maintaining an asset management policy
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Creating and maintaining an asset management policy
    Creating and maintaining physical and environmental security policy
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Creating and maintaining physical and environmental security policy
    Creating and maintaining report on the review of the ICT risk management framework
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Creating and maintaining report on the review of the ICT risk management framework
    Develop and maintain an ICT project management policy
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Develop and maintain an ICT project management policy
    Requirements for creating policies
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Requirements for creating policies
    Establishing risk profile
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Establishing risk profile
    Safeguards to protect PHI
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Safeguards to protect PHI
    Security officer appointment and responsibilities (HIPAA)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Security officer appointment and responsibilities (HIPAA)
    Evaluating compliance with HIPAA requirements
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Evaluating compliance with HIPAA requirements
    Establishing and maintaining the comprehensive ePHI security program
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Establishing and maintaining the comprehensive ePHI security program
    Protection from retaliation and intimidation
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Protection from retaliation and intimidation
    Protecting HIPAA rights from being waived
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Protecting HIPAA rights from being waived
    Implementation of policies and procedures
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Implementation of policies and procedures
    Policies and procedures for HIPAA compliance
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    No items found.
    See all related requirements and other information from tasks own page.
    Go to >
    Policies and procedures for HIPAA compliance
    Appointing a qualified cybersecurity auditor (Malta)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    14.1: Ħatra u approvazzjoni ta’ awditur kwalifikat għall-verifika ta’ miżuri taċ-ċibersigurtà
    NIS2 Malta
    See all related requirements and other information from tasks own page.
    Go to >
    Appointing a qualified cybersecurity auditor (Malta)
    Designation of the information security officer (Spain)
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    Artículo 16.2: Comunicación de la designación del responsable
    NIS2 Spain
    Artículo 16.1: Designación del responsable de la seguridad de la información
    NIS2 Spain
    Artículo 16.4: Cualificaciones y posición organizativa
    NIS2 Spain
    See all related requirements and other information from tasks own page.
    Go to >
    Designation of the information security officer (Spain)
    Statement of applied security measures (Spain)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Artículo 15.5: Declaración de aplicabilidad de sistemas
    NIS2 Spain
    See all related requirements and other information from tasks own page.
    Go to >
    Statement of applied security measures (Spain)
    Cybersecurity compliance requirements for essential and important entities (Spain)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Artículo 15.4: Demostración y certificación de cumplimiento
    NIS2 Spain
    See all related requirements and other information from tasks own page.
    Go to >
    Cybersecurity compliance requirements for essential and important entities (Spain)
    Adoption and implementation of security measures
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Art. 13.3.4: Identification, sélection et priorisation des mesures de sécurité intérieure
    Loi infrastructures critiques
    § 4-3.(1-2): Plikt til å gjennomføre sikkerhetstiltak
    Sikkerhetsloven
    See all related requirements and other information from tasks own page.
    Go to >
    Adoption and implementation of security measures
    Risk-based selection of security measures
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Art. 13.3.4: Identification, sélection et priorisation des mesures de sécurité intérieure
    Loi infrastructures critiques
    § 4-3.(1-2): Plikt til å gjennomføre sikkerhetstiltak
    Sikkerhetsloven
    See all related requirements and other information from tasks own page.
    Go to >
    Risk-based selection of security measures
    Security Plan development and implementation
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Art. 13.4: Période de mise en œuvre des mesures de sécurité
    Loi infrastructures critiques
    See all related requirements and other information from tasks own page.
    Go to >
    Security Plan development and implementation
    Security contact point for critical infrastructure
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Art. 12.1-3: Point de contact pour la sécurité
    Loi infrastructures critiques
    13.3: Designated personnel
    CER
    See all related requirements and other information from tasks own page.
    Go to >
    Security contact point for critical infrastructure
    Development and maintenance of the Operator Security Plan (O.S.P.) (Belgium)
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Art. 13.1: Plan de sécurité de l'opérateur
    Loi infrastructures critiques
    Art. 13.6: Organisation des exercices et mise à jour de l'P.S.E.
    Loi infrastructures critiques
    See all related requirements and other information from tasks own page.
    Go to >
    Development and maintenance of the Operator Security Plan (O.S.P.) (Belgium)
    Advance notification of planned cybersecurity audits
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    33.5: Ankündigung geplanter Prüfungen
    NIS2 Austria
    See all related requirements and other information from tasks own page.
    Go to >
    Advance notification of planned cybersecurity audits
    Self-declaration submission (Austria)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    33.1: Selbstdeklaration
    NIS2 Austria
    See all related requirements and other information from tasks own page.
    Go to >
    Self-declaration submission (Austria)
    Proof Obligations for Operators of Critical Infrastructure (Germany)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    39.1: Nachweispflichten für Betreiber kritischer Anlagen
    NIS2 Germany
    See all related requirements and other information from tasks own page.
    Go to >
    Proof Obligations for Operators of Critical Infrastructure (Germany)
    Annual cybersecurity maturity self-assessment and reporting
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    12.4: Transmiterea autoevaluării anuale a maturității cibernetice
    NIS2 Romania
    See all related requirements and other information from tasks own page.
    Go to >
    Annual cybersecurity maturity self-assessment and reporting
    Appointment of a Cyber Security Officer (Romania)
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    14.3: Alocarea resurselor și desemnarea responsabililor de securitate
    NIS2 Romania
    14.4: Cerințe pentru responsabilul cu securitatea
    NIS2 Romania
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment of a Cyber Security Officer (Romania)
    Registration for official communication systems
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Art. 9: Registrierung
    CSV
    See all related requirements and other information from tasks own page.
    Go to >
    Registration for official communication systems
    Process for clarifying reporting obligations (Switzerland)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Art. 13: Einreichung von Unterlagen zur Abklärung der Meldepflicht
    CSV
    See all related requirements and other information from tasks own page.
    Go to >
    Process for clarifying reporting obligations (Switzerland)
    Cooperation with supervisory authorities
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    § 4-5.2: Varsling av tilsynsmyndigheten
    Sikkerhetsloven
    § 14: Opplysningsplikt og tilgang til lokaler og utstyr
    NIS2 NO
    See all related requirements and other information from tasks own page.
    Go to >
    Cooperation with supervisory authorities
    Ensure the integrity of critical national information
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    § 5-2: Beskyttelse av skjermingsverdig informasjon
    Sikkerhetsloven
    § 6-2: Beskyttelse av skjermingsverdige informasjonssystemer
    Sikkerhetsloven
    See all related requirements and other information from tasks own page.
    Go to >
    Ensure the integrity of critical national information
    Notifying authorities of high-risk procurements
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    § 9-4.2: Varsling til departementet
    Sikkerhetsloven
    See all related requirements and other information from tasks own page.
    Go to >
    Notifying authorities of high-risk procurements
    Notify termination of security-sensitive activity
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    § 2.6: Anmälningsplikt
    SSL
    See all related requirements and other information from tasks own page.
    Go to >
    Notify termination of security-sensitive activity
    Notify start of security-sensitive activity
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    § 2.6: Anmälningsplikt
    SSL
    See all related requirements and other information from tasks own page.
    Go to >
    Notify start of security-sensitive activity
    Appointment and role of the Security Protection Manager
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    § 2.7: Säkerhetsskyddschef
    SSL
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment and role of the Security Protection Manager
    Appointment of a Chief Information Security Officer (Greece)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    15.5.α: Υπεύθυνος ασφάλειας πληροφοριών
    NIS2 Greece
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment of a Chief Information Security Officer (Greece)
    Review reporting of simplified ICT risk management framework
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 41: Format and content of the report on the review of the simplified ICT risk management framework
    DORA simplified RMF
    See all related requirements and other information from tasks own page.
    Go to >
    Review reporting of simplified ICT risk management framework
    ICT project management procedure
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Article 38: ICT project and change management
    DORA simplified RMF
    See all related requirements and other information from tasks own page.
    Go to >
    ICT project management procedure
    Auditing of risk management framework
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 28: Governance and organization
    DORA simplified RMF
    See all related requirements and other information from tasks own page.
    Go to >
    Auditing of risk management framework
    Creation and maintenance of governance and control framework
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 28: Governance and organization
    DORA simplified RMF
    See all related requirements and other information from tasks own page.
    Go to >
    Creation and maintenance of governance and control framework
    Notification of a significant incident with cross-border and cross-sectoral impact
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Članak 40: Obavještavanje o značajnom incidentu s prekograničnim i međusektorskim učinkom
    NIS2 Croatia
    15.3: Informații privind impactul transfrontalier al incidentelor
    NIS2 Romania
    See all related requirements and other information from tasks own page.
    Go to >
    Notification of a significant incident with cross-border and cross-sectoral impact
    Conducting an external audit
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    Članak 34: Provedba revizije kibernetičke sigurnosti
    NIS2 Croatia
    11.5: Auditului de securitate
    NIS2 Romania
    See all related requirements and other information from tasks own page.
    Go to >
    Conducting an external audit
    Notifying the administrative body of incidents
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Art. 23.3: Comunicazione
    NIS2 Italy
    See all related requirements and other information from tasks own page.
    Go to >
    Notifying the administrative body of incidents
    Appointment of a Cyber Security Officer (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    4
    requirements

    Examples of other requirements this task affects

    15.3.: Kibernetinio saugumo vaidmenys ir atsakomybė
    NIS2 Lithuania
    15.4.: Kibernetinio saugumo valdymo užsakymas
    NIS2 Lithuania
    15.5.: Kibernetinio saugumo vadovas ir saugos įgaliotinis reikalavimai
    NIS2 Lithuania
    15.2.: Paskirti saugos įgaliotinį
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment of a Cyber Security Officer (Lithuania)
    Appointment of a Chief Information Security Officer (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    4
    requirements

    Examples of other requirements this task affects

    15.3.: Kibernetinio saugumo vaidmenys ir atsakomybė
    NIS2 Lithuania
    15.4.: Kibernetinio saugumo valdymo užsakymas
    NIS2 Lithuania
    15.5.: Kibernetinio saugumo vadovas ir saugos įgaliotinis reikalavimai
    NIS2 Lithuania
    15.1.: Paskirti kibernetinio saugumo vadovą
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment of a Chief Information Security Officer (Lithuania)
    Cybersecurity auditing (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    14.8.: Kibernetinio saugumo auditai
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Cybersecurity auditing (Lithuania)
    Technical cyber security measures (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    16.4.: Esminiai subjektai sudary sąlygas Nacionaliniam kibernetinio saugumo centrui technines kibernetinio saugumo priemones
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Technical cyber security measures (Lithuania)
    Usage of data centers (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    38.1.: Duomenų centrų naudojimas saugaus tinklo naudotojams
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Usage of data centers (Lithuania)
    Usage of the Secure Network (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    37.1.: Saugus institucijų tinklas (Valstybės ir savivaldybių institucijos ir įstaigos, valstybės valdomos įmonės ir viešosios įstaigos)
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Usage of the Secure Network (Lithuania)
    Cyber Security Information System usage (Lithuania)
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    19.1.: Kibernetinio saugumo informacinė sistema
    NIS2 Lithuania
    19.3.: Kibernetinio saugumo informacinės sistemos naudojimas
    NIS2 Lithuania
    19.4.: Dalijimosi informacija susitarimai
    NIS2 Lithuania
    See all related requirements and other information from tasks own page.
    Go to >
    Cyber Security Information System usage (Lithuania)
    Providing the security managers information to a competent authority
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    25.(2): Paziņojums par kiberdrošības vadītāja iecelšanu
    NIS2 Latvia
    25.(3): Kiberdrošības pārvaldnieka atbilstība
    NIS2 Latvia
    25.(4): Paziņojums par izmaiņām
    NIS2 Latvia
    See all related requirements and other information from tasks own page.
    Go to >
    Providing the security managers information to a competent authority
    Appointment, tasks and position of a Cyber security manager
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    25.(5): kiberdrošības pārvaldnieka pienākumi
    NIS2 Latvia
    25.(1): Kiberdrošības pārvaldību
    NIS2 Latvia
    See all related requirements and other information from tasks own page.
    Go to >
    Appointment, tasks and position of a Cyber security manager
    Assessment of conformity (Belgium)
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    39: Conformité et audits
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Assessment of conformity (Belgium)
    Documentation of organization's dependencies on external resources
    Critical
    High
    Normal
    Low
    Cyber security management
    3
    requirements

    Examples of other requirements this task affects

    GV.OC-05: Organizational dependencies on outcomes and services
    NIST 2.0
    § 4-2: Vurdering av risiko
    Sikkerhetsloven
    § 7: Risikovurdering
    NIS2 NO
    See all related requirements and other information from tasks own page.
    Go to >
    Documentation of organization's dependencies on external resources
    Strategic directions of risk response options
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    GV.RM-04: Strategic direction of risk response options
    NIST 2.0
    See all related requirements and other information from tasks own page.
    Go to >
    Strategic directions of risk response options
    Identify the organisation's strategy and priorities
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    1.1.1: Identify the organisation’s strategy and priorities
    NSM ICT-SP
    See all related requirements and other information from tasks own page.
    Go to >
    Identify the organisation's strategy and priorities
    Implementing a crisis response strategy
    Critical
    High
    Normal
    Low
    Cyber security management
    22
    requirements

    Examples of other requirements this task affects

    RC.CO-2: Reputation is repaired after an incident.
    CyberFundamentals
    4.3.5: Co-ordinate and communicate with internal and external stakeholders while managing the incident
    NSM ICT-SP
    4.3.2: Determine whether the incident is under control and take the necessary reactive measures
    NSM ICT-SP
    30 § 1°: Gestion des risques et maîtrise des incidents
    NIS2 Belgium
    30 § 3.3°: La continuité et la gestion des crises
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Implementing a crisis response strategy
    Recognizing and listing sensitive work fields and jobs
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    2.1.1: Competence of employees
    TISAX
    See all related requirements and other information from tasks own page.
    Go to >
    Recognizing and listing sensitive work fields and jobs
    Description of cyber security structure
    Critical
    High
    Normal
    Low
    Cyber security management
    4
    requirements

    Examples of other requirements this task affects

    1.2.2: Information Security Responsibilities
    TISAX
    14.3: Alocarea resurselor și desemnarea responsabililor de securitate
    NIS2 Romania
    § 9: Organisatoriske sikkerhetstiltak
    NIS2 NO
    See all related requirements and other information from tasks own page.
    Go to >
    Description of cyber security structure
    Monitoring and analysing effectiveness of digital operational resilience strategy
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    Article 13: Learning and evolving
    DORA
    See all related requirements and other information from tasks own page.
    Go to >
    Monitoring and analysing effectiveness of digital operational resilience strategy
    Learning from testing operational resilience
    Critical
    High
    Normal
    Low
    Cyber security management
    5
    requirements

    Examples of other requirements this task affects

    Article 13: Learning and evolving
    DORA
    RC.IM-1: Recovery plans incorporate lessons learned.
    CyberFundamentals
    ID.IM-02: Improvements from security tests and exercises
    NIST 2.0
    Art. 13.6: Organisation des exercices et mise à jour de l'P.S.E.
    Loi infrastructures critiques
    13.1.d: Recovering from incidents
    CER
    See all related requirements and other information from tasks own page.
    Go to >
    Learning from testing operational resilience
    Adequate security principles of the organisation in terms of classified information
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    T-01: JOHDON TUKI, OHJAUS JA VASTUU – TURVALLISUUSPERIAATTEET
    Katakri 2020
    § 2.4: Personalsäkerhetsskyddsåtgärder
    SSL
    See all related requirements and other information from tasks own page.
    Go to >
    Adequate security principles of the organisation in terms of classified information
    Defining security roles and responsibilities
    Critical
    High
    Normal
    Low
    Cyber security management
    45
    requirements

    Examples of other requirements this task affects

    T02: Turvallisuustyön tehtävien ja vastuiden määrittäminen
    Katakri
    24. Responsibility of the controller
    GDPR
    6.1.1: Information security roles and responsibilities
    ISO 27001
    ID.AM-6: Cybersecurity roles and responsibilities
    NIST
    ID.GV-2: Cybersecurity role coordination
    NIST
    See all related requirements and other information from tasks own page.
    Go to >
    Defining security roles and responsibilities
    Amount, competence and adequacy of key cyber security personnel
    Critical
    High
    Normal
    Low
    Cyber security management
    37
    requirements

    Examples of other requirements this task affects

    T03: Turvallisuustyön resurssit
    Katakri
    32. Security of processing
    GDPR
    37. Designation of the data protection officer
    GDPR
    6.1.1: Information security roles and responsibilities
    ISO 27001
    ID.GV-2: Cybersecurity role coordination
    NIST
    See all related requirements and other information from tasks own page.
    Go to >
    Amount, competence and adequacy of key cyber security personnel
    Management commitment to cyber security management and management system
    Critical
    High
    Normal
    Low
    Cyber security management
    49
    requirements

    Examples of other requirements this task affects

    Članak 29.a: Upravljanje
    NIS2 Croatia
    1.1.1: Availability of information security policies
    TISAX
    31 § 1°: Approbation des mesures de gestion des risques de cybersécurité
    NIS2 Belgium
    PR.AT-4: Senior executives understand their roles and responsibilities.
    CyberFundamentals
    ID.GV-1: Organizational cybersecurity policy is established and communicated.
    CyberFundamentals
    See all related requirements and other information from tasks own page.
    Go to >
    Management commitment to cyber security management and management system
    Incident management resourcing and monitoring
    Critical
    High
    Normal
    Low
    Cyber security management
    19
    requirements

    Examples of other requirements this task affects

    24. Responsibility of the controller
    GDPR
    7.2.1: Management responsibilities
    ISO 27001
    16.1.1: Responsibilities and procedures
    ISO 27001
    5.24: Information security incident management planning and preparation
    ISO 27001
    Article 17: ICT-related incident management process
    DORA
    See all related requirements and other information from tasks own page.
    Go to >
    Incident management resourcing and monitoring
    General security competence and awareness of personnel
    Critical
    High
    Normal
    Low
    Cyber security management
    42
    requirements

    Examples of other requirements this task affects

    Članak 29.b: Osposobljavanja
    NIS2 Croatia
    10 §: Johdon vastuu
    Kyberturvallisuuslaki
    2.1.3: Staff training
    TISAX
    2.1.1: Competence of employees
    TISAX
    31 § 2°: Formation des cadres supérieurs à la cybersécurité
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    General security competence and awareness of personnel
    Defining and documenting cyber security metrics
    Critical
    High
    Normal
    Low
    Cyber security management
    29
    requirements

    Examples of other requirements this task affects

    Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
    NIS2 Croatia
    4.1: Tietojärjestelmien tietoturvallisuus
    TiHL tietoturvavaatimukset
    9.1 §: Toimien vaikuttavuuden arviointi
    Kyberturvallisuuslaki
    13 §: Tietoaineistojen ja tietojärjestelmien tietoturvallisuus
    TiHL
    30 § 3.6°: L'efficacité des mesures de gestion des risques
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Defining and documenting cyber security metrics
    Implementation and documentation of management reviews
    Critical
    High
    Normal
    Low
    Cyber security management
    54
    requirements

    Examples of other requirements this task affects

    Članak 29.a: Upravljanje
    NIS2 Croatia
    Članak 30.1.f: Politike i postupke za procjenu djelotvornosti mjera upravljanja kibernetičkim sigurnosnim rizicima
    NIS2 Croatia
    10 §: Johdon vastuu
    Kyberturvallisuuslaki
    1.2.1: Scope of Information Security management
    TISAX
    31 § 1°: Approbation des mesures de gestion des risques de cybersécurité
    NIS2 Belgium
    See all related requirements and other information from tasks own page.
    Go to >
    Implementation and documentation of management reviews
    Communication plan for information security management system
    Critical
    High
    Normal
    Low
    Cyber security management
    32
    requirements

    Examples of other requirements this task affects

    Članak 29.a: Upravljanje
    NIS2 Croatia
    31 § 1°: Approbation des mesures de gestion des risques de cybersécurité
    NIS2 Belgium
    2.10.1: Include security in the organisation’s change management process
    NSM ICT-SP
    RC.CO-2: Reputation is repaired after an incident.
    CyberFundamentals
    ID.GV-1: Organizational cybersecurity policy is established and communicated.
    CyberFundamentals
    See all related requirements and other information from tasks own page.
    Go to >
    Communication plan for information security management system
    Continuous improvement and documentation
    Critical
    High
    Normal
    Low
    Cyber security management
    28
    requirements

    Examples of other requirements this task affects

    1.5.2: External review of ISMS
    TISAX
    30 § 6°: Non-conformités et mesures correctives
    NIS2 Belgium
    PR.IP-7: Protection processes are improved.
    CyberFundamentals
    ID.GV-1: Organizational cybersecurity policy is established and communicated.
    CyberFundamentals
    PR.IP-7: Protection processes
    NIST
    See all related requirements and other information from tasks own page.
    Go to >
    Continuous improvement and documentation
    Archiving and retaining outdated security documentation
    Critical
    High
    Normal
    Low
    Cyber security management
    1
    requirements

    Examples of other requirements this task affects

    A.10.2: Retention period for administrative security policies and guidelines
    ISO 27018
    See all related requirements and other information from tasks own page.
    Go to >
    Archiving and retaining outdated security documentation
    Segregation of information security related duties
    Critical
    High
    Normal
    Low
    Cyber security management
    10
    requirements

    Examples of other requirements this task affects

    6.1.2: Segregation of duties
    ISO 27001
    ID.RA-3: Threat identification
    NIST
    PR.AC-4: Access permissions and authorizations
    NIST
    PR.DS-5: Data leak protection
    NIST
    HAL-02.1: Tehtävät ja vastuut - tehtävien eriyttäminen
    Julkri
    See all related requirements and other information from tasks own page.
    Go to >
    Segregation of information security related duties
    Security roles, responsibilities, and objectives derived from the organization's goals
    Critical
    High
    Normal
    Low
    Cyber security management
    5
    requirements

    Examples of other requirements this task affects

    ID.BE-3: Organizational mission, objectives, and activities
    NIST
    69: Digiturvan huomiointi osana kokonaisuutta
    Digiturvan kokonaiskuvapalvelu
    ID.BE-3: Priorities for organizational mission, objectives, and activities are established and communicated.
    CyberFundamentals
    GV.RR-02: Roles and responsibilities in cybersecurity risk management
    NIST 2.0
    GV.OC-01: Cybersecurity risk management aligned with the organizational mission
    NIST 2.0
    See all related requirements and other information from tasks own page.
    Go to >
    Security roles, responsibilities, and objectives derived from the organization's goals
    Kasautumisvaikutuksen huomiointi suojattavien kohteiden luokittelussa
    Critical
    High
    Normal
    Low
    Cyber security management
    2
    requirements

    Examples of other requirements this task affects

    HAL-04.3: Suojattavat kohteet - kasautumisvaikutus
    Julkri
    2.4: Luokittelu ja turvallisuusluokittelu
    TiHL tietoturvavaatimukset
    See all related requirements and other information from tasks own page.
    Go to >
    Kasautumisvaikutuksen huomiointi suojattavien kohteiden luokittelussa

    Never duplicate effort. Do it once - improve compliance across frameworks.

    Reach multi-framework compliance in the simplest possible way‍
    Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
    Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
    Do it once - we automatically apply it to all current and future frameworks.
    Start free trial
    Get to know Cyberday
    Start your free trial
    Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
    With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
    Clear framework compliance plans
    Activate relevant frameworks and turn them into actionable policies tailored to your needs.
    Credible reports to proof your compliance
    Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
    AI-powered improvement suggestions
    Focus on the most impactful improvements in your compliance with help from Cyberday AI.
    Effortless compliance improvement
    Widest framework library in EU
    Extensive support

    Start your compliance journey

    Use in MS Teams or use your browser with Slack integration.
    Risk free trial. No credit card required. Stop at any time.

    Start free 14-day trial
    Book a meeting
    How it works?
    SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templates
    Use cases
    By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
    By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementPrivacy managementVendor assessments
    Resources
    AcademyWebinarsBlogHelp articlesVideo coursesContent libraryGuidesNewsletterLeave a reviewPartner programTeamTerms of usePrivacy policy
    Contact us
    +358 10 231 6010
    team@cyberday.ai
    App works in:
    Known in Finland as Digiturvamalli
    © Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
    Cyberday.ai - Improve and certify your cyber security