Cybersecurity Risk Analysis

7. The head of the cybersecurity entity or a person authorised by them must establish a procedure for assessing and managing the risk of the entity's network and information systems, covering:

• 7.1. the appointment of a person or persons responsible for risk assessment, for overseeing the risk assessment process and for its continuous improvement

• 7.2. the assessment and management process

• 7.3. the level of risk acceptable to the cybersecurity entity

• 7.4. the requirements for how often risk assessment is carried out.

8. The risk assessment and management process must cover at least the following elements:

• 8.1. identification and classification of network and information systems

• 8.2. risk analysis covering the analysis and assessment of threats and vulnerabilities, the potential impact, and the calculation of risk

• 8.3. the selection of risk management measures.

9. A risk assessment must be carried out at least once a year, when significant organisational or other material changes occur in the cybersecurity entity, and also after a major cyber incident.

10. After carrying out a risk assessment, cybersecurity entities must prepare a risk assessment report and, where shortcomings to be remedied are identified during the risk assessment, a risk management plan; these are approved by the head of the cybersecurity entity or a person authorised by them.

11. The risk assessment report must cover at least the identification of network and information systems assets, the impact assessment, information on the assessment of threats and vulnerabilities, and the results of the risk calculation according to the criteria established by the cybersecurity entity, as well as risk management.

12. The risk management plan must cover at least the identification of measures for managing unacceptable risks and the resources required, the persons responsible for implementing the measures, and the deadlines for their implementation.

13. The cybersecurity entity submits the approval details of the risk assessment report and the risk management plan — stating the date of approval and the registration number, together with the summarised results identified during the risk assessment: the threats identified, their likelihood and impact on operations, risk levels and management measures — to KSIS no later than 5 working days from the approval of those documents.

14. Risk assessment reports and risk management plans approved by the head of the cybersecurity entity or a person authorised by them must be retained for at least 3 years.

15. When carrying out an inspection of a cybersecurity entity, the NCSC has the right to require the cybersecurity entity to provide a copy of the risk assessment report and a copy of the risk management measures plan. The cybersecurity entity must submit these documents to KSIS no later than 5 working days from the date of receipt of the NCSC request.