Measuring the effectiveness of security measures
Catalog reference
Set a policy and procedures to assess whether your cybersecurity risk-management measures are carried out and kept effective. Base them on your risk assessment and on past significant incidents. Decide which measures, processes and controls you monitor and measure, the methods that give valid results, when to measure, who measures, when the results are analysed and evaluated, and who does that. Review and update the policy and procedures on a schedule and after significant incidents or changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Narrative — how we satisfy this requirement
No narrative yet. Add one.