Secure acquisition, development and maintenance
Catalog reference
Based on the security requirements of art. 7(5), have an adopted policy to mitigate and control the risks from acquiring software, hardware or services that relate to your network and information systems. Put the policy in writing and apply it demonstrably (art. 11(1)). Where it applies, set processes and procedures for the secure development of your network and information systems, covering every development phase, and apply them demonstrably (art. 11(2)). Set processes and procedures for the maintenance and management of your network and information systems, covering at least configuration management and change management, and apply them demonstrably (art. 11(3)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 12) elaborates this for essential and important entities in its sectors: the maintenance processes cover at least security testing and security patch management (patches from trusted sources, checked for integrity and, where appropriate, tested before production, and applied within a reasonable time or the reason for not doing so is documented); you also detect and prevent malicious and unauthorised software, run vulnerability scans where appropriate and record the results, evaluate your exposure to vulnerabilities and threats, remedy vulnerabilities without delay or document why not, and segment your network and information systems into networks or zones in line with the risk analysis and, where appropriate, from those of third parties. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.
Narrative — how we satisfy this requirement
No narrative yet. Add one.