keyboard_tab Cyber Resilience Act 2023/2841 EN

(a)

cybersecurity policy, including measures needed to reach objectives and priorities referred to in Article 6 and paragraph 3 of this Article;

(b)

policies on cybersecurity risk analysis and information system security;

(c)

policy objectives regarding the use of cloud_computing_services;

(d)

cybersecurity audit, where appropriate, which may include a cybersecurity risk, vulnerability and cyber_threat assessment, and penetration testing carried out by a trusted private provider on a regular basis;

(e)

implementation of recommendations resulting from cybersecurity audits referred to in point (d) through cybersecurity and policy updates;

(f)

organisation of cybersecurity, including establishment of roles and responsibilities;

(g)

asset management, including ICT asset inventory and ICT network cartography;

(h)

human resources security and access control;

(i)

operations security;

(j)

communications security;

(k)

system acquisition, development and maintenance, including policies on vulnerability handling and disclosure;

(l)

where possible, policies on the transparency of the source code;

(m)

supply chain security, including security-related aspects concerning the relationships between each Union entity and its direct suppliers or service providers;

(n)

incident handling and cooperation with CERT-EU, such as the maintenance of security monitoring and logging;

(o)

business continuity management, such as backup management and disaster recovery, and crisis management; and

(p)

promotion and development of cybersecurity education, skills, awareness-raising, exercise and training programmes.

(a)

technical arrangements to enable and sustain teleworking;

(b)

concrete steps for moving towards zero-trust principles;

(c)

the use of multifactor authentication as a norm across network_and_information_systems;

(d)

the use of cryptography and encryption, in particular end-to-end encryption, as well as secure digital signing;

(e)

where appropriate, secured voice, video and text communications, and secured emergency communications systems within the Union entity;

(f)

proactive measures for detection and removal of malware and spyware;

(g)

the establishment of software supply chain security through criteria for secure software development and evaluation;

(h)

the establishment and adoption of training programmes on cybersecurity commensurate to the prescribed tasks and expected capabilities for the highest_level_of_management and members of staff of the Union entity tasked with ensuring the effective implementation of this Regulation;

(i)

regular cybersecurity training of staff members;

(j)

where relevant, participation in interconnectivity risk analyses between the Union_entities;

(k)

the enhancement of procurement rules to facilitate a high common level of cybersecurity through: