The organization must classify its electronic information systems into "basic", "significant", or "high" security classes. This classification must be based on the integrity and availability of the system, as well as the confidentiality, integrity, and availability risks of the data processed by it.
Based on the assigned security class of each electronic information system, the organization should determine and implement the specific protection measures.
The organization should record the results of the electronic information system security classification in a dedicated register or within its internal regulations. The head of the organization is responsible for ensuring the compliance, completeness, and timeliness of the recorded data.
The organization should review the security classification of its electronic information systems in a documented manner at least every two years. An immediate review must be conducted if any change affecting the security of an electronic system occurs.
.svg)
