keyboard_tab Cyber Resilience Act 2023/2841 EN

(a)

cybersecurity policy, including measures needed to reach objectives and priorities referred to in Article 6 and paragraph 3 of this Article;

(b)

policies on cybersecurity risk analysis and information system security;

(c)

policy objectives regarding the use of cloud_computing_services;

(d)

cybersecurity audit, where appropriate, which may include a cybersecurity risk, vulnerability and cyber_threat assessment, and penetration testing carried out by a trusted private provider on a regular basis;

(e)

implementation of recommendations resulting from cybersecurity audits referred to in point (d) through cybersecurity and policy updates;

(f)

organisation of cybersecurity, including establishment of roles and responsibilities;

(g)

asset management, including ICT asset inventory and ICT network cartography;

(h)

human resources security and access control;

(i)

operations security;

(j)

communications security;

(k)

system acquisition, development and maintenance, including policies on vulnerability handling and disclosure;

(l)

where possible, policies on the transparency of the source code;

(m)

supply chain security, including security-related aspects concerning the relationships between each Union entity and its direct suppliers or service providers;

(n)

incident handling and cooperation with CERT-EU, such as the maintenance of security monitoring and logging;

(o)

business continuity management, such as backup management and disaster recovery, and crisis management; and

(p)

promotion and development of cybersecurity education, skills, awareness-raising, exercise and training programmes.

(a)

technical arrangements to enable and sustain teleworking;

(b)

concrete steps for moving towards zero-trust principles;

(c)

the use of multifactor authentication as a norm across network_and_information_systems;

(d)

the use of cryptography and encryption, in particular end-to-end encryption, as well as secure digital signing;

(e)

where appropriate, secured voice, video and text communications, and secured emergency communications systems within the Union entity;

(f)

proactive measures for detection and removal of malware and spyware;

(g)

the establishment of software supply chain security through criteria for secure software development and evaluation;

(h)

the establishment and adoption of training programmes on cybersecurity commensurate to the prescribed tasks and expected capabilities for the highest_level_of_management and members of staff of the Union entity tasked with ensuring the effective implementation of this Regulation;

(i)

regular cybersecurity training of staff members;

(j)

where relevant, participation in interconnectivity risk analyses between the Union_entities;

(k)

the enhancement of procurement rules to facilitate a high common level of cybersecurity through:

(a)

support them with the implementation of this Regulation and contribute to the coordination of the implementation of this Regulation through the measures listed in Article 14(1) or through ad-hoc reports requested by the IICB;

(b)

offer standard CSIRT services for Union_entities by means of a package of cybersecurity services described in its service catalogue (baseline services);

(c)

maintain a network of peers and partners to support the services as outlined in Articles 17 and 18;

(d)

bring to the attention of the IICB any problems relating to the implementation of this Regulation and the implementation of guidelines, recommendations and calls for action;

(e)

on the basis of the information referred to in paragraph 2, contribute to the Union cyber situational awareness in close cooperation with ENISA;

(f)

coordinate the management of major incidents;

(g)

act on the part of Union_entities as the equivalent of the coordinator designated for the purposes of coordinated vulnerability disclosure pursuant to Article 12(1) of Directive (EU) 2022/2555;

(h)

provide, upon the request of a Union entity, proactive non-intrusive scanning of publicly accessible network_and_information_systems of that Union entity.

(a)

preparedness, incident coordination, information exchange and crisis response at the technical level on cases linked to Union_entities;

(b)

operational cooperation regarding the CSIRTs network, including with regard to mutual assistance;

(c)

cyber_threat intelligence, including situational awareness;

(d)

on any topic requiring CERT-EU’s technical cybersecurity expertise.

(a)

services that support the cybersecurity of Union_entities’ ICT environment, other than those referred to in paragraph 3, on the basis of service level agreements and subject to available resources, in particular broad-spectrum network monitoring, including first-line 24/7 monitoring for high-severity cyber_threats;

(b)

services that support cybersecurity operations or projects of Union_entities, other than those to protect their ICT environment, on the basis of written agreements and with the prior approval of the IICB;

(c)

upon request, a proactive scanning of the network_and_information_systems of the Union entity concerned to detect vulnerabilities with a potential significant impact;

(d)

services that support the security of their ICT environment to organisations other than the Union_entities that cooperate closely with Union_entities, for instance by having tasks or responsibilities conferred under Union law, on the basis of written agreements and with the prior approval of the IICB.