Security policy and responsibilities

Catalog reference

Adopt a security policy for your network and information systems, approved by the management body and dated. The policy sets your approach and objectives, commits to keep improving and to provide the people, money, processes, tools and technology to carry it out, names the documentation to keep and for how long, lists the topic-specific policies, and defines indicators that track how mature your security is. Tell staff and relevant outside parties about it. Review it at least once a year and after significant incidents or changes, and record the result. Assign security roles, responsibilities and authorities to match your needs, tell the management body who holds them, have at least one person report to it directly, separate conflicting duties, require staff and third parties to follow the policy, and review the assignments on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement