Duties of the Persons Responsible for Cybersecurity and of the Head of the Cybersecurity Entity or a Person Authorised by Them

16. The head of the cybersecurity entity or a person authorised by them must appoint the persons responsible for cybersecurity referred to in Article 15 of the Cybersecurity Law, and other persons responsible for implementing the requirements of the Description.

17. The head of the cybersecurity entity or a person authorised by them must ensure that the NCSC is informed via KSIS of the appointed persons responsible for cybersecurity, and that contact information with the content specified in the KSIS regulations is provided.

18. The employees of the cybersecurity entity must be informed of the appointed persons responsible for cybersecurity.

19. The cybersecurity manager and/or the security officer may not perform functions relating to the administration of networks or information systems, or other positions relating to the maintenance and management of computer hardware or software.

20. In coordinating and overseeing the implementation of the requirements laid down in the cybersecurity policy documents, the cybersecurity manager and/or the security officer must perform the following functions:

• 20.1. organise the assessment of the cybersecurity entity's compliance with the requirements of this Description in accordance with the procedure laid down in the Cybersecurity Audit Methodology approved by the NCSC

• 20.2. ensure that the cybersecurity policy documents are prepared and periodically updated on the basis of the requirements of the Cybersecurity Law and its implementing legal acts

• 20.3. coordinate investigations of cyber incidents in network and information systems and cooperate with the competent authorities investigating cyber incidents and unlawful acts related to cyber incidents

• 20.4. issue binding instructions and assignments to the network and information systems administrator(s) and/or users in relation to the implementation of the requirements laid down in the cybersecurity policy documents

• 20.5. organise the risk assessment and take part in the risk assessment process, prepare and submit risk assessment reports and risk management plans for approval to the head of the cybersecurity entity or a person authorised by them

• 20.6. organise employee training on cybersecurity matters

• 20.7. perform the other functions laid down and assigned to them in the cybersecurity policy documents and in other legal acts governing cybersecurity.

21. The head of the cybersecurity entity or a person authorised by them must appoint a responsible person (administrator) to maintain the networks and/or information systems and ensure their operation. The functions of that person must cover the management of access rights of users of the network and information systems, the maintenance of network and information systems components (computers, operating systems, databases, application software, firewalls, intrusion detection systems), the configuration of those information system components, the identification of information system vulnerabilities, the determination and monitoring of compliance with security requirements, and response to cyber incidents.