NIST CSF 2.0, GovernGV.PO-01

Take technical, operational and organisational measures appropriate to the risk your network and information systems face, covering at minimum a risk analysis and information-system-security policy, incident handling, business continuity and crisis management, supply chain security, and security in the acquisition, development and maintenance of your systems.

Maintain basic cyber hygiene practices and cybersecurity training, policies on cryptography and encryption where appropriate, human resources security and access control, and multi-factor authentication or continuous authentication solutions where appropriate.

Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; supply-chain security, including vulnerability handling and disclosure for your direct suppliers and service providers; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic cyber-hygiene practices; and, where appropriate, multi-factor or continuous authentication.

Cover each of: the security of your systems and installations; incident management; business-continuity management; monitoring, audit and control; and compliance with international standards.

Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.

Document your compliance with this duty.

Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where relevant, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication and secure voice, video, text and emergency communications.

Have a written information-security policy, updated annually and approved by your board of directors.

Issue an information-security policy for your users and the requirements it sets, and review it at least every two years.

Maintain a documented security policy and risk-management process, assess and re-assess risk on a regular basis, and put in place technical and organisational security measures, including access control, tested regularly against current international best practice.

As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.

Cover at least: risk-analysis and information-system security policies; incident handling, including the procedures and tools to carry out the Article 25 and 26 notifications; business continuity, including backup management, disaster recovery and crisis management; and supply-chain security.

Appoint a member of senior management as Chief Information Security Officer, and develop, implement, communicate to staff and keep records of technical and organisational policies, practices and processes to manage risk to your network and information infrastructure and to prevent, mitigate and remedy a cybersecurity incident.

Prepare policies and take preventive measures and procedures against crimes committed by electronic means, including a cybercrime risk analysis, a budget for an information-technology security policy, insurance covering electronic-crime risk, a continuously updated incident-response and business-continuity plan, a dedicated prevention team, and employee and customer awareness training.

Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and disaster recovery, and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluating your measures' effectiveness; basic cyber-hygiene procedures and training; cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, plus secured voice, video and text communication.

Adopt and keep current cybersecurity policy documents, periodically analyse and manage your cybersecurity risks, designate the persons responsible for cybersecurity, manage cybersecurity incidents and report on them, secure your supply chain, and deploy technical cybersecurity measures.

Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and crisis management; supply-chain security, including the security of your relationships with direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; evaluating the effectiveness of your own risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; personnel security, access-control policy and asset management; and multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency communication systems as needed.

At minimum: conduct rolling cybersecurity risk assessments at a frequency the Chief Information Security Officer prescribes; develop and implement internal cybersecurity policies and procedures, an internal incident-reporting policy, and an internal cybersecurity awareness program; and transmit the resulting mitigation actions to the Director within thirty days of completing each risk assessment.

Conduct a cybersecurity risk assessment of that infrastructure at least every two years, and maintain an internal cybersecurity policy, an internal cybersecurity incident-reporting policy, and an internal cybersecurity awareness program.

If designated, adopt a cyber-security risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act and system-governance acts, apply cryptographic protection where your work requires it, and assess the effectiveness of these measures (Article 16).

Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.

Once it applies, implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.

Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.

Cover at least: risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of your risk-management measures; cryptography and encryption policy; supply-chain security, including the security of your relationship with your direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access control and asset management; incident management; business continuity, including backups, disaster recovery and crisis management; basic cyber-hygiene practices and training; and multi-factor or continuous authentication.

Adopt a security act built on that risk-assessment act, setting the principles, methods and procedures for reaching and keeping an adequate level of system security and the authority and responsibility for security and resources, and check your applied protection measures against it at least once a year, alone or with outside experts, producing a report on the check.

Within 12 months of your registration as an essential-service operator, and graded by your own risk analysis, adopt, maintain and carry out general security measures covering at minimum: information- and cyber-security governance; vulnerability and threat management; asset and risk management; incident and event handling; business continuity, backup and disaster recovery; secure acquisition, development and configuration of your networks, systems and applications; compliance assessment and control; cryptography; human-resources security; identity and access management; network-operations security; protection against malicious code and unwanted content; system, network and communications security; event monitoring, logging and reporting; physical and endpoint security; records, privacy and information-labelling protection; supply-chain security; and procurement and use of certified ICT products, services and processes.

Cover at minimum: management support for information and cybersecurity, personnel integrity checks before, during and after employment, basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, logging of events on your network and information systems, and, where relevant, supply-chain security, cryptography and encryption policy, and multi-factor or continuous authentication.

Adopt technical and organisational measures, proportionate to the risk and reflecting the state of the art, to manage the risks to the networks and information systems you use to provide the service, even where that management is outsourced; as a digital service provider, address at minimum the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.

Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.

Formulate, revise and implement a cyber security maintenance plan matching the agency's assigned responsibility level, and submit its implementation status and any corrective-action report to the central competent authority in charge of the relevant sector.

Draw up an info-communications security maintenance plan covering the management scope and classification of covered systems, compliance-verification measures, plan-implementation measures, and joint-defense and incident-response measures, and implement it.

Where the competent authority designates the enterprise's PSTN, in whole or in part, as critical telecommunications infrastructure, additionally draw up a critical telecommunications infrastructure protection plan before the competent authority's own deadline, submit it for the competent authority's evaluation before implementing it, and comply with the technical specifications for info-communications security evaluation the competent authority sets for that infrastructure.

Absent that safe harbor, develop, implement, and maintain a data security program with reasonable administrative safeguards (a designated coordinator, a risk assessment, employee training, vetted service-provider contracts, and periodic adjustment), reasonable technical safeguards (assessing network and software design risk, detecting and responding to attacks, and testing controls), and reasonable physical safeguards (securing storage and disposal and limiting access during and after collection).

To seek that defense, create, maintain, and comply with a written cybersecurity program with administrative, technical, and physical safeguards, covering personal information alone or personal information together with restricted information, and scale the program to the covered entity's size and complexity, the nature and scope of its activities, the sensitivity of the information protected, the cost and availability of security tools, and the resources available to it.

Satisfy this duty either by already being subject to and complying with Gramm-Leach-Bliley Act Title V regulations, HIPAA and HITECH regulations, or another state or federal law providing greater protection, or by implementing an information security program with a designated coordinator, a periodic risk assessment, employee training, vetted service-provider contracts, network and software risk assessment and patch management, attack detection and testing, and secure destruction of records when the information is no longer needed.

Implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to your size and scope, the nature of the information, and the purpose for which it was collected, to protect the information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.

To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.

At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.

At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.