CIR 2024/2690 Implementation Guide

Policy on the security of network and information systems

Requires a documented security policy approved by management, reviewed at least annually, and updated after significant incidents or changes. Must define roles, responsibilities, and the framework for all subsequent measures. Must include a risk acceptance policy and evidence of management commitment.

Risk management

Requires a documented risk assessment methodology, risk identification covering all critical assets and processes, risk analysis with likelihood and impact assessment, risk treatment with documented decisions (accept, mitigate, transfer, avoid), and residual risk acceptance by management. Must be reviewed at planned intervals and after significant changes.

Incident handling

Requires incident detection, classification, response, and recovery procedures. Must define roles and responsibilities for incident handling, establish communication channels, include post-incident analysis (lessons learned), and maintain incident logs. Detection must include monitoring for anomalies and known indicators of compromise.

Business continuity and crisis management

Requires business impact analysis, continuity plans for critical services, backup and recovery procedures with tested restore capabilities, and crisis management procedures. Backup integrity must be verified regularly. Recovery time objectives must be defined and tested. Plans must be reviewed after incidents or significant changes.

Supply chain security

Requires a supply chain security policy, assessment of direct suppliers' cybersecurity practices, contractual security requirements for ICT products and services, and monitoring of supplier security posture over the contract lifecycle. Must consider supply chain-specific risks including those arising from the supplier's own supply chain.

Security in acquisition, development, and maintenance

Requires secure development lifecycle for in-house development, security requirements for acquired ICT products and services, configuration management, change management procedures, and security testing (including vulnerability scanning and penetration testing where appropriate). Must cover the full lifecycle from acquisition through decommissioning.

Cryptography

Requires a policy on the use of cryptography, including selection of cryptographic algorithms and key lengths appropriate to the classification of data, key management procedures (generation, distribution, storage, rotation, revocation, destruction), and periodic review of cryptographic implementations against current best practices and known vulnerabilities.

Access control and asset management

Requires an access control policy based on business and security requirements, identity management with unique user identification, access provisioning and de-provisioning procedures, privileged access management, and an asset inventory covering all network and information system components. Access rights must be reviewed at planned intervals.

Multi-factor authentication and secure communication

Requires multi-factor authentication or continuous authentication for access to critical systems and remote access. Secure communication channels must be established for emergency and fallback scenarios. Voice, video, and text communications used for incident response must be secured against interception.

Cybersecurity awareness and training

Requires regular cybersecurity awareness programmes for all personnel, role-specific training for staff with security responsibilities, and management training on cybersecurity governance. Training must cover the entity's security policies, common threats, incident reporting procedures, and the personnel's specific responsibilities.