Network and Information Systems Security Policy

4. The head of the cybersecurity entity or a person authorised by them must approve a network and information systems cybersecurity policy document, which must set out:

• 4.1. the objectives of the activities ensuring cybersecurity, formulated in accordance with the cybersecurity principles laid down in the Cybersecurity Law

• 4.2. a list of the legal acts governing cybersecurity that are followed

• 4.3. other cybersecurity policy documents followed when implementing the network and information systems security policy

• 4.4. the cybersecurity policy obligations to be complied with by employees and third parties

• 4.5. commitments to review and update the cybersecurity policy documents regularly, at least once a year or when circumstances change.

5. Cybersecurity entities must submit and/or update the approval details of the cybersecurity policy document(s) — stating the document title, date of approval and registration number — to the National Cyber Security Centre under the Ministry of National Defence (hereinafter — the NCSC) in the Cybersecurity Information System (hereinafter — KSIS) no later than 5 working days from the date on which the document(s) was approved and/or amended.

6. When carrying out an inspection of a cybersecurity entity, the NCSC has the right to request copies of the documents referred to in paragraph 3 of the Description to be submitted to KSIS no later than 5 working days from the date of receipt of the NCSC request.