Incident handling and logging

Catalog reference

Have an adopted incident handling policy, put it in writing and apply it demonstrably (art. 8(1)). Set the roles, responsibilities and authorities to detect incidents in time, analyse and assess them, respond to them, limit their effect, remove their cause and recover from them, document them, report them and learn from them (art. 8(2)). Set processes and procedures to monitor relevant events in your network and information systems so you can detect, analyse and classify incidents, and apply them demonstrably (art. 8(3)). Set processes and procedures for the same six activities as in paragraph 2, and apply them demonstrably (art. 8(4) and (5)). Log the events in your network and information systems that matter for their security, keep the logs for a set period and protect them against unauthorised change (art. 8(6)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement