Requirement

1.1: The network and information system security policy

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall:

set out the relevant entities’ approach to managing the security of their network and information systems;
be appropriate to and complementary with the relevant entities’ business strategy and objectives;
set out network and information security objectives;
include a commitment to continual improvement of the security of network and information systems;
include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies;
be communicated to and acknowledged by relevant employees and relevant interested external parties;
lay down roles and responsibilities pursuant to point 1.2;
list the documentation to be kept and the duration of retention of the documentation;
list the topic-specific policies;
lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security;
indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).

2. The network and information system security policy shall be reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result of the reviews shall be documented.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

NIS2 Implementing Regulation

Other requirements of the framework

1.1: The network and information system security policy

Best practices

How to implement:

1.1: The network and information system security policy

This policy on

1.1: The network and information system security policy

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555, the policy on the security of network and information systems shall:

set out the relevant entities’ approach to managing the security of their network and information systems;
be appropriate to and complementary with the relevant entities’ business strategy and objectives;
set out network and information security objectives;
include a commitment to continual improvement of the security of network and information systems;
include a commitment to provide the appropriate resources needed for its implementation, including the necessary staff, financial resources, processes, tools and technologies;
be communicated to and acknowledged by relevant employees and relevant interested external parties;
lay down roles and responsibilities pursuant to point 1.2;
list the documentation to be kept and the duration of retention of the documentation;
list the topic-specific policies;
lay down indicators and measures to monitor its implementation and the current status of relevant entities’ maturity level of network and information security;
indicate the date of the formal approval by the management bodies of the relevant entities (the ‘management bodies’).

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

1.1: The network and information system security policy

Task name

Priority

Task completes