Assessing the Effectiveness of Cybersecurity Requirements

48. The head of the cybersecurity entity or a person authorised by them must establish a procedure for assessing the effectiveness of cybersecurity requirements, covering:

• 48.1. the requirement to assess regularly, at least once a year, the cybersecurity entity's compliance with the Cybersecurity Law, with this Description and with the requirements laid down in the cybersecurity policy documents approved by the entity (hereinafter — the Compliance Assessment).

• 48.2. once the cybersecurity entity has carried out the Compliance Assessment, the following are prepared and approved by the head of the entity or a person authorised by them:
• 48.2.1. the compliance assessment report
• 48.2.2. a plan for remedying the non-conformities identified (if any), assigning the persons responsible, the resources required and the deadlines for implementation.

• 48.3. the requirement to carry out a cybersecurity audit regularly, at least once every 3 years, in accordance with the provisions of point 8 of Article 14 of the Cybersecurity Law

49. Taking into account the results of the risk assessment, the cybersecurity incidents that have occurred and the results of managing them, the cybersecurity entity shall establish requirements for assessing the effectiveness of the cybersecurity measures applied:

• 49.1. which cybersecurity requirement management measures are to be monitored and assessed

• 49.2. which monitoring, measurement, analysis and assessment methods the cybersecurity entity applies

• 49.3. how often the monitoring and measurements using the established methods are to be carried out

• 49.4. the persons responsible for monitoring and measuring the effectiveness assessment

• 49.5. how often the results of the effectiveness assessment are analysed

• 49.6. improvement of the cybersecurity measures applied, having regard to the assessment results.

50. When carrying out an inspection of a cybersecurity entity, the NCSC has the right to require the entity to provide copies of the cybersecurity audit carried out, the compliance assessment report, the plan for remedying the non-conformities identified during the compliance assessment, the risk assessment report and the risk management plan. The cybersecurity entity must submit these documents to KSIS no later than 5 working days from the date of receipt of the NCSC request.

51. An essential cybersecurity entity shall submit an assessment of compliance with cybersecurity requirements at least once a year by completing the NCSC questionnaire in KSIS.