CIR 2024/2690 Implementation Guide

Policy on the security of network and information systems

Requires a documented network and information systems security policy approved by management, setting the entity's approach to managing security, reviewed at planned intervals and updated after significant incidents or changes. It frames all the measures that follow.

Risk management policy

Requires a risk management framework with a defined methodology, identification of risks to network and information systems, analysis and evaluation against risk acceptance criteria, a treatment plan, and approval of residual risk by management, reviewed at planned intervals.

Incident handling

Requires policy and procedures for detecting, analysing, containing, responding to, and recovering from incidents, with defined roles, logging, escalation and communication, and a structured post-incident review that feeds lessons learned back into the measures.

Business continuity and crisis management

Requires a business continuity and disaster recovery plan based on a business impact analysis, backup and redundancy management with tested restore procedures, and a crisis management plan with defined roles, reviewed and tested at planned intervals.

Supply chain security

Requires a supply chain security policy governing relationships with direct suppliers and service providers, including security criteria for selection, contractual requirements, and a directory of suppliers maintained and monitored over the relationship lifecycle.

Security in network and information systems acquisition, development and maintenance

Requires security to be built into the acquisition, development, and maintenance of systems, covering secure development practices, configuration management, change management, security testing, patch management, and handling of vulnerabilities throughout the lifecycle.

Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

Requires the entity to define policies and procedures to assess whether its risk-management measures are effective, including monitoring, review, and independent assessment, so that shortcomings are identified and the measures are improved over time.

Basic cyber hygiene practices and security training

Requires basic cyber hygiene practices and a security awareness programme for all personnel, with role-specific training for staff who have security tasks and for management, covering policies, threats, and reporting duties.

Cryptography

Requires a policy and procedures on the use of cryptography, including selection of algorithms and key strengths appropriate to the data, and key management covering generation, storage, rotation, and destruction, reviewed against current best practice.

Human resources security

Requires human resources security measures across the employment lifecycle, including verification before hiring as appropriate, defined security responsibilities, terms and conditions, and procedures for changes of role and termination so that access ends when employment does.

Access control

Requires an access control policy with management of access rights (11.2) and privileged accounts (11.3), administration systems (11.4), unique identification (11.5), authentication (11.6), and multi-factor or continuous authentication (11.7) for access to critical systems and remote access, reviewed at planned intervals.

Asset management

Requires an asset management policy with classification of assets, an inventory of network and information systems and supporting assets, handling rules according to classification, and policies for removable media and the secure return or disposal of assets.

Environmental and physical security

Requires protection of facilities against physical and environmental threats, including supporting utilities, controlled physical access to systems, and protection against failures such as power loss, fire, and water, proportionate to the risk to the systems.