Ge Luis regelverket. Få en organisation som följer det.

Krav hittade

8

Delar i planen

8

Ej täckta

0

NIS2 Articles 20, 21 and 23 setup

1. Registerrader

   NIS2 Directive (EU 2022/2555) and the national cybersecurity actKeep NIS2 visible as a legal requirement whose applicability and implementation must be assessed.

   • Track NIS2 applicability and the relevant national implementing requirements.

2. Formulär

   NIS2 Risk-management Measures ReviewCollect consistent risk assessments and evidence across all Article 21 measures.

   • Assess all Article 21 risk-management measure areas with supporting evidence.

3. Process

   NIS2 Risk-management Review and RemediationTurn Article 21 assessments into owned actions, verification and management decisions.

   • Assign remediation owners, deadlines, effectiveness checks and residual-risk approval.

4. Formulär

   NIS2 Management Approval and Training RecordPreserve evidence of management approval, oversight and cybersecurity training.

   • Record management training, competence assessment and employee training follow-up.

5. Process

   NIS2 Management Oversight and TrainingGive management a repeatable approval and oversight cycle with documented training.

   • Document management approval and oversight of cybersecurity measures under Article 20.

6. Ändrad process

   Security Incident Triage & Response ProcessAdd Article 23 significance assessment, reporting clocks and evidence to the existing incident response.

   • Extend existing incident handling with significance assessment and 24-hour, 72-hour and one-month reporting deadlines, including ongoing incidents.

7. Ändrat formulär

   Supplier Security & Compliance AssessmentCapture the supplier-specific evidence needed for Article 21 supply-chain security decisions.

   • Collect supplier security evidence covering vulnerabilities, secure development and operational safeguards.

8. Ändrad process

   Supplier Review & Approval ProcessMake supplier security reviews risk-based, evidence-led and subject to a clear acceptance decision.

   • Extend existing supplier reviews with risk-based security assessment, approval and monitoring.

Varje krav Luis hittade uppfylls av en del i planen.

Krav hittade

14

Delar i planen

9

Ej täckta

0

Incident handling aligned with the Information Security Incident Policy

1. Egenskaper

   Event noticed at, Report received at, Incident awareness at, Incident severity, Incident assessment, Incident action log, Root cause and lessons learned, Evidence retention instructionCapture the timestamps and decisions needed to demonstrate compliance with the policy.

2. Posttyp

   Information Security Incident ReportKeep incident reports consistently identifiable across public reporting and response.

3. Posttyp

   External Incident NotificationScope CISO approval specifically to external incident notifications.

4. Ändrat formulär

   Incident reportMake the existing report form collect the facts needed for rapid triage.

   • Employees and contractors report immediately, within one hour of noticing, even if unsure.

5. Workflow

   Public Security Event ReportingProvide the public reporting entry point required by the policy.

   • Anyone, including external people, can report through a public reporting page.

6. Policy

   CISO approval of external incident notificationsRequire CISO approval before any external incident notification is sent.

   • The CISO approves every external notification before submission.

7. Workflow

   External Incident Notification ApprovalKeep notification wording, approval and submission evidence together.

8. Ändrad process

   Security Incident Triage & Response ProcessMake triage, response, notification and closure follow the policy's deadlines.

   • The Security Officer assesses every report within four hours.
   • Classify event versus incident, severity, NIS2 significance and GDPR breach status.
   • The incident lead coordinates containment and recovery and logs every action with time and owner.
   • Send significant-incident early warning within 24 hours, notification within 72 hours and final report within one month.
   • Notify the data protection authority within 72 hours for personal data breaches likely to result in risk.
   • Every incident has root cause and lessons learned within ten working days.
   • Track corrective actions until closed.
   • Keep all reports, assessments, notifications and lessons learned for five years.
   • Reuse the existing incident process and report form rather than create duplicates.

9. Process

   Incident Reporting Training and Incident Lead ExerciseTrack onboarding training, annual refresher training and annual incident-lead exercises.

   • All employees complete incident reporting training at onboarding and every year.
   • Incident leads take a yearly exercise.

Varje krav Luis hittade uppfylls av en del i planen.

Krav hittade

15

Delar i planen

10

Ej täckta

0

Employee onboarding and offboarding

1. Egenskaper

   Employment start date, Last employment day, Probation end date, Employee team, Employee role, Employee equipment serial numbers, Employee record disposal review dateKeep the employee dates, access decisions and equipment identifiers available as structured information.

2. Posttyp

   Employment agreementIdentify employment agreements consistently for signing and archiving.

3. Posttyp

   Employee confidentiality agreementKeep signed employee confidentiality commitments identifiable.

4. Policy

   HR review of employment agreements, HR review of employee confidentiality agreementsHave HR verify employee agreements before they are sent for signature.

5. Workflow

   Employment agreement signingAllow onboarding to obtain a signed employment agreement before the first day.

   • The employment agreement is signed before the first day.

6. Workflow

   Employee confidentiality signingObtain the employee's confidentiality commitment before their first day.

   • The confidentiality agreement is signed before the first day.

7. Formulär

   Employee first-week confirmationsCollect policy acknowledgements and evidence of the required security test.

   • The employee acknowledges the information security policy, code of conduct and privacy policy in the first week.

8. Ändrad process

   Employee Onboarding & Access ProvisioningMake onboarding follow the policy's approvals, signing and first-week deadlines.

   • HR registers the employee's start date, manager, team and role before the first day.
   • The manager approves requested access before IT grants it.
   • Access to systems with personal data also requires data-owner approval.
   • The employee passes the security awareness test with at least 80% in the first week.
   • IT issues a laptop and phone and records their serial numbers against the employee.
   • The manager conducts a review before the six-month probation period ends.
   • Reuse the existing onboarding, offboarding and access review Process Configurations.

9. Ändrad process

   Employee Offboarding & Access RevocationCoordinate last-day revocation, equipment return and post-employment record retention.

   • The manager starts offboarding at least five working days before the last day.
   • IT removes all access on the last employment day.
   • The employee returns all equipment and HR confirms continuing confidentiality obligations.
   • Onboarding and offboarding records are retained for employment plus two years.

10. Ändrad process

    Access Review & RecertificationEnsure each manager reviews their team's access every year.

    • Each manager reviews their team's access annually.

Varje krav Luis hittade uppfylls av en del i planen.

Krav hittade

5

Delar i planen

4

Ej täckta

0

GDPR handling and processing-activity reviews

1. Ändrad process

   Data Subject Request HandlingSo requests are verified, tracked and answered within the applicable GDPR deadline.

   • Answer data subject requests within one calendar month, with only permitted GDPR extensions.

2. Ändrad process

   Personal Data Breach HandlingSo breach decisions and required notifications are made within the 72-hour window.

   • Assess personal data breaches and notify the competent authority within 72 hours of awareness when required.
   • Document non-notification decisions and assess whether affected individuals must be informed.

3. Formulär

   Record of Processing ActivitiesSo each processing activity has a consistent, reviewable Article 30 record.

   • Capture the Article 30 record of processing activities in a structured format.

4. Process

   Processing Activity Maintenance & Annual ReviewSo processing records are updated when activities change and reviewed at least annually.

   • Keep processing-activity records up to date and review each activity yearly.

Varje krav Luis hittade uppfylls av en del i planen.