Risk management, compliance monitoring and independent review

Catalog reference

Keep a risk management framework for the security of your network and information systems. Follow a risk method, set your risk tolerance and criteria, identify and document risks across all hazards (third parties and weak points included), analyse them for threat, likelihood, impact and level using threat and vulnerability intelligence, evaluate them against the criteria, prioritise treatment, name who treats each risk and by when, and record the choices and the reasons for accepting residual risk in a risk treatment plan. The management body, or the people with authority to manage risk, accepts the results. Review the assessment and the plan at least once a year and after significant changes or incidents. Check compliance with your own policies, rules and standards regularly, report it to the management body, and have an independent review of your security approach, carried out by people with audit competence who are not under the authority of the area they review, on a schedule and after significant incidents or changes. Report the results to the management body and act on them or accept the risk. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement