Risk management policy

Catalog reference

Have an adopted risk management policy for the security of your network and information systems, put it in writing and apply it demonstrably (art. 7(1)). The policy covers at least a risk management method and criteria for accepting risk (art. 7(2)). Set processes and procedures for risk analysis, risk assessment and risk treatment, and apply them demonstrably (art. 7(3)). From the risk analysis, draw up an overview of the risks to the security of your network and information systems (art. 7(4)). Based on that overview, set security requirements for your network and information systems; where the analysis gives reason, take measures that secure them in a structural and demonstrable way (art. 7(5)). Articles 10 and 11 of the decree measure your suppliers and acquisitions against these requirements. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement