NIST CSF 2.0, GovernGV.OV-03

Keep an overview of the security measures you have introduced, will introduce with deadlines, priority and a responsible person, and have not introduced with reasons; update it and evaluate the measures' effectiveness at least once a year; keep each version for at least four years (Section 3(2)).

Establish a policy and procedures to assess whether your cybersecurity risk-management measures are effectively implemented and maintained (point 7.1), offer your employees an awareness raising programme and give those whose roles require security skills regular training (points 8.1.2 and 8.2.1), and apply the Annex's requirements on cryptography, human resources security, access control, asset management, and environmental and physical security (points 9 to 13).

Unless you are a microenterprise, assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, keep ICT risk management, control and internal audit functions segregated, have the framework audited internally on a regular basis by auditors with sufficient knowledge, skills and expertise in ICT risk, and establish a formal follow-up process for critical ICT audit findings (Article 6(4), (6) and (7)).

Report at least once a year, or more frequently if relevant, the outcome of your monitoring activities, including information on new cyber-attacks, and confirm that the mitigations implemented are still effective (paragraph 7.4.1).