12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
MIL1 requirements
a. Risk responses (such as mitigate, accept, avoid, or transfer) are implemented to address cyber risks, at least in an ad hoc manner
MIL2 requirements
b. A defined method is used to select and implement risk responses based on analysis and prioritization
MIL3 requirements
c. Cybersecurity controls are evaluated to determine whether they are designed appropriately and are operating as intended to mitigate identified cyber risks
d. Results from cyber risk impact analyses and cybersecurity control evaluations are reviewed together by enterprise leadership to determine whether cyber risks are sufficiently mitigated, and risk tolerances are not exceeded
e. Risk responses (such as mitigate, accept, avoid, or transfer) are reviewed periodically by leadership to determine whether they are still appropriate
The organization proactively seeks to list and assess the likelihood and severity of various cyber security risks. The documentation shall include the following:
When implementing information security risk management, the organisation must identify the risks that require treatment and define treatment plans for them, which often consist of new information security measures.
The organisation has defined how regularly the treatment plans defined as a whole are evaluated and their proportionality to the risk assessment (risk severity and probability).
.png)
