Invosec
The CoverContact UsOur Insights
Explore
NIS2

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure

NIS2 Documents

Provisions and Requirements
Requirements for Testing the Effectiveness of the Network and Information Systems Business Continuity Management PlanRequirements for Reporting the Results of Business Continuity Management Plan TestingBackup Recovery Parameter RequirementsNetwork and Information Systems Data Loss Time (RPO) RequirementsBackup RequirementsHuman Resources Security RequirementsNon-Disclosure RequirementsPhysical Access Requirements for Network and Information SystemsProvisions on Multi-Factor Authentication SolutionsAdministrator Access RequirementsPassword Creation and Change RequirementsNetwork and Information Systems Acquisition and Deployment RequirementsProvisions on Updating Permitted SoftwareProvisions on the Use of Security SystemsSecurity System Update RequirementsProvisions on the Use of Network Filtering EquipmentProvisions on the Secure Use of EmailInformation Classification and Handling RequirementsProvisions on the Use of Cryptography and EncryptionRisk Assessment Frequency RequirementsRequirements for Log Management and Retention, Intrusion Detection and Prevention
Plans
Cyber Incident Management PlanRisk Management PlanPlan for Remediating Non-Conformities Found in the Compliance AssessmentNetwork and Information Systems Business Continuity (Recovery) Management PlanVulnerability Identification PlanEffectiveness Monitoring Plan
Policies
Network and Information Systems Cybersecurity PolicyHuman Resources Security and Physical Access Policy
Registers and Forms
Cyber Incident Notification FormInterim Situation Update Report FormRisk Assessment Report FormCybersecurity Training Report FormCompliance Assessment Report FormList of Permitted SoftwareCyber Incident (Minor and Significant) Information FormCyber Incident Investigation Report FormList of SuppliersList of Persons with Administrator RightsBusiness Continuity Management Plan Test Report Form for Network and Information SystemsList of Premises Requiring ProtectionNetwork and Information Systems Asset InventoryCyber Incident Management Plan Test Report FormVulnerability Detection Report FormHardware Fault RegisterService Provider Risk Assessment Form
Diagrams and Processes
Network and Information Systems DiagramNetwork and Information Systems Infrastructure Logical DiagramRisk Assessment and Management ProcessTypical Cyber Incident Management Process
Procedures
Network and Information Systems Risk Assessment and Management ProcedureCryptography and Encryption Use ProcedureCyber Hygiene Practice and Cybersecurity Training Organisation and Delivery ProcedureCybersecurity Requirements Effectiveness Evaluation ProcedureNetwork and Information Systems Acquisition, Development and Maintenance Security ProcedureSupply Chain Security ProcedureAccess Management and Multi-Factor Authentication MeasuresAsset Management ProcedurePatch and Vulnerability Management ProcedureNetwork and Information Systems Change Management ProcedureLog Management Procedure
Procedures

Network and Information Systems Risk Assessment and Management Procedure

Sets who assesses the cybersecurity risk of network and information systems and how often, the acceptable risk level, and how the risk assessment report and risk management plan are prepared.

KSRA

KSRA Chapter II, Section Two (7–15)

Under the Cybersecurity Requirements Description (KSRA), the risk assessment procedure sets how the organisation assesses the cybersecurity risk of its network and information systems, how often the assessment is repeated and how its results are documented.

Under KSRA, the procedure sets out:
  • ● responsible persons, the risk assessment and management process, the acceptable risk level and the assessment frequency (KSRA points 7.1–7.4);
  • ● the process elements — identification and classification of network and information systems, threat and vulnerability analysis, impact assessment, risk calculation, selection of measures (KSRA points 8.1–8.3);
  • ● risk assessment at least once a year, after significant changes and after a significant incident (KSRA point 9);
  • ● preparation, approval and content of the risk assessment report and the risk management plan — measures, resources, responsible persons, deadlines (KSRA points 10–12);
  • ● submission of approval details via KSIS, the national cybersecurity information system; on request of the NKSC (the National Cyber Security Centre) during an inspection — copies of the report and the plan via KSIS within 5 working days (KSRA points 13, 15);
  • ● retention of reports and plans approved by the head of the entity for at least 3 years (KSRA point 14).

The risk management plan, the risk assessment report form and the risk assessment process diagram are not separate procedures — they are produced by applying this procedure.

KSI

KSĮ Art. 14(5)(1)

The Law on Cybersecurity (KSĮ) names risk analysis and policy as one of the elements of the cybersecurity requirements (KSĮ Art. 14(5)(1)).