Bekendtgørelse om modstandsdygtighed og beredskab i energisektoren (Danmark)

Requirement

§ 47: Identifikation, reaktion og afbødning af sårbarheder

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

Virksomheder skal være i stand til at identificere, reagere på og mitigere sårbarheder, som kan påvirke sikkerheden i virksomhedens net- og informationssystemer.

Stk. 2. Virksomheder skal være i stand til at modtage varsler om sårbarheder på elektronisk vis.

Stk. 3. Virksomheder skal ved modtagelse af et varsel om en sårbarhed foretage en risikovurdering af virksomhedens eksponering og mitigere sårbarheder, som kan påvirke sikkerheden i virksomhedens net- og informationssystemer.

Stk. 4. Virksomheder i niveau 4 og 5 skal være i stand til at reagere på varsler efter stk. 2 og 3 uden unødigt ophold.

Stk. 5. Virksomheder skal tage stilling til, om sårbarheder, som virksomheden identificerer i virksomhedens net- og informationssystemer, bør offentliggøres, herunder i forbindelse med erhvervelse, udvikling og vedligeholdelse af net- og informationssystemer, jf. § 45.

Stk. 6. Virksomheder skal sikre, at oplysninger om sårbarheder, som kan have sikkerhedsmæssig betydning for energisektoren, videreformidles til Energistyrelsen. Virksomheder i el-, gas- og brintsektoren skal ligeledes videreformidle oplysning om sårbarheder, til Energinet.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

Bekendtgørelse om modstandsdygtighed og beredskab i energisektoren (Danmark)

Other requirements of the framework

§ 47: Identifikation, reaktion og afbødning af sårbarheder

Best practices

How to implement:

§ 47: Identifikation, reaktion og afbødning af sårbarheder

This policy on

§ 47: Identifikation, reaktion og afbødning af sårbarheder

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

Virksomheder skal være i stand til at identificere, reagere på og mitigere sårbarheder, som kan påvirke sikkerheden i virksomhedens net- og informationssystemer.

Stk. 2. Virksomheder skal være i stand til at modtage varsler om sårbarheder på elektronisk vis.

Stk. 4. Virksomheder i niveau 4 og 5 skal være i stand til at reagere på varsler efter stk. 2 og 3 uden unødigt ophold.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

§ 47: Identifikation, reaktion og afbødning af sårbarheder

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

No other tasks found.

Complete these tasks in Cyberday ISMS ->

How to comply with this requirement

In Cyberday, requirements and controls are mapped to universal tasks. Each requirement is fulfilled with one or multiple tasks.

Here's a list of tasks that help you comply with the requirement

§ 47: Identifikation, reaktion og afbødning af sårbarheder

of the framework

Bekendtgørelse om modstandsdygtighed og beredskab i energisektoren (Danmark)

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

Process for managing technical vulnerabilities

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Process for managing technical vulnerabilities

This task helps you comply with the following requirements

12.6.1: Management of technical vulnerabilities ISO 27001

14.2.1: Secure development policy ISO 27001

ID.RA-1: Asset vulnerabilities NIST

PR.IP-12: Vulnerability management plan NIST

RS.AN-5: Vulnerability management process NIST

Standards for submitting vulnerability reports

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Standards for submitting vulnerability reports

This task helps you comply with the following requirements

39: Koordinēta ievainojamību atklāšana NIS2 Latvia

§ 24.5: Hlásenie kybernetických hrozieb a zraniteľností NIS2 Slovakia

§ 47: Identifikation, reaktion og afbødning af sårbarheder Energisektor beredskabsbekendtgørelse

Process for vulnerability remediation

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Process for vulnerability remediation

This task helps you comply with the following requirements

40.(1): Ievainojamību atklāšana un novēršana NIS2 Latvia

40.(2): Neaizsargātību novēršanas grafiks NIS2 Latvia

Art. 24.2.e.2: Sicurezza dell'acquisizione NIS2 Italy

Article 13.1(.2.a): Known exploitable vulnerabilities CRA

§ 47: Identifikation, reaktion og afbødning af sårbarheder Energisektor beredskabsbekendtgørelse

Process for handling and sharing vulnerability disclosures

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Process for handling and sharing vulnerability disclosures

This task helps you comply with the following requirements

RS.AN-5: Processes are established to receive, analyse, and respond to vulnerabilities disclosed to the organization from internal and external sources.CyberFundamentals

ID.RA-08: Processes for handling vulnerability disclosures NIST 2.0

30 § 3.11°: Divulgation des vulnérabilités NIS2 Belgium

14.5.6): Tinklų ir informacinių sistemų saugumą NIS2 Lithuania

Vuln.6: Sharing information about potential vulnerabilities CRA

Regular vulnerability scanning

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Regular vulnerability scanning

This task helps you comply with the following requirements

12.6.1: Management of technical vulnerabilities ISO 27001

14.2.8: System security testing ISO 27001

18.2.3: Technical compliance review ISO 27001

6.5: Tietojärjestelmien asennus, ylläpito ja päivitys Omavalvontasuunnitelma

ID.RA-1: Asset vulnerabilities NIST

Initial treatment of identified technical vulnerabilities

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Initial treatment of identified technical vulnerabilities

This task helps you comply with the following requirements

12.6.1: Management of technical vulnerabilities ISO 27001

ID.RA-1: Asset vulnerabilities NIST

PR.IP-12: Vulnerability management plan NIST

RS.AN-5: Vulnerability management process NIST

RS.MI-3: New vulnerability mitigation NIST

Regular penetration testing

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Regular penetration testing

This task helps you comply with the following requirements

12.6.1: Management of technical vulnerabilities ISO 27001

14.2.8: System security testing ISO 27001

18.2.3: Technical compliance review ISO 27001

DE.CM-8: Vulnerability scans NIST

5.36: Compliance with policies, rules and standards for information security ISO 27001

Keeping contact with relevant authorities

Critical

High

Normal

Low

Partner management

Agreements and monitoring

Keeping contact with relevant authorities

This task helps you comply with the following requirements

6.1.3: Contact with authorities ISO 27001

RC.CO-1: Public relations NIST

5.5: Contact with authorities ISO 27001

23.1: Incident notifications to CSIRT and recipients of services NIS2

CC2.3: Communication with external parties SOC 2

Monitoring of technical vulnerability communications

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Monitoring of technical vulnerability communications

This task helps you comply with the following requirements

50: Teknisten haavoittuvuuksien seuranta Digiturvan kokonaiskuvapalvelu

THREAT-1: Reduce Cybersecurity Vulnerabilities C2M2

9.3 §: Tietojärjestelmien hankinta ja kehittäminen Kyberturvallisuuslaki

Article 34: ICT operations security DORA simplified RMF

§ 47: Identifikation, reaktion og afbødning af sårbarheder Energisektor beredskabsbekendtgørelse

Regular monitoring of the vulnerability management process

Critical

High

Normal

Low

Development and cloud

Technical vulnerability management

Regular monitoring of the vulnerability management process

This task helps you comply with the following requirements

12.6.1: Management of technical vulnerabilities ISO 27001

ID.RA-1: Asset vulnerabilities NIST

PR.IP-12: Vulnerability management plan NIST

TEK-19: Ohjelmistohaavoittuvuuksien hallinta Julkri

8.8: Management of technical vulnerabilities ISO 27001

Complete these tasks in Cyberday ISMS ->

The ISMS component hierachy

When building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.

Framework

Sets the overall compliance standard or regulation your organization needs to follow.

Requirements

Break down the framework into specific obligations that must be met.

Tasks

Concrete actions and activities your team carries out to satisfy each requirement.

Policies

Documented rules and practices that are created and maintained as a result of completing tasks.