NIST CSF 2.0, GovernGV.RR-01

Designate at least one management board member (or, if you have only one, that member, or the equivalent office-holder if you have no board) to approve your security measures, monitor their implementation and answer for that duty, and have that person complete regular training to understand and assess cyber risk, its impact on your services, and how to manage it.

Have the accountable manager or, for a design organization, the head of the design organization ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.D.OR.240(a) to (c)).

Have the accountable manager ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.I.OR.240(a) to (c)).

Have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. Have your management body define, approve, oversee and answer for all arrangements under the ICT risk management framework, bear the ultimate responsibility for managing ICT risk, set and approve the digital operational resilience strategy and risk tolerance level, and approve and review your ICT business continuity policy, response and recovery plans, ICT internal audit plans and policy on the use of ICT third-party services (Article 5(1) and (2)).

Have your management body approve these measures, oversee their implementation, and complete cybersecurity training.

Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.

In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.

Have your management body implement and oversee these measures and attend regular risk-management training; expect it to be liable to your organisation for culpable damage from a breach of that duty under the ordinary rules of company law.

If you are an essential or important entity under Section 28 of the BSI Act, base those measures on an all-hazards approach that covers at least risk analysis and security concepts, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability management and disclosure, effectiveness assessment, basic cyber hygiene and training, cryptography, personnel security and access control, and multi-factor or continuous authentication (Section 165(2a)); have your management implement and monitor them and take part in regular training (Section 165(2b) and (2d)).

Within three months of this duty's entry into force, have your management body approve the cybersecurity risk-management measures you take to comply with the measures below, supervise their implementation, and ensure every board member receives training and that equivalent training reaches your staff at least annually.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.

Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.

Introduce and document an ICT risk-management and control framework for which your management bears overall responsibility, and apply it in proportion to your scope, staff, services and use of ICT (points 3, 5 and 6).

Have your leadership body (Leitungsorgan) approve and oversee these measures and attend, and offer your staff, regular training on recognising and assessing cybersecurity risk and risk-management practice.

Have your management body approve these risk-management measures, oversee their implementation, and complete regular training on assessing risk and risk-management practice; expect the body to be held liable for the entity's violation of this duty.

Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).

Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.

Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.

Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.

Have your governing body approve these measures, supervise their implementation and bear responsibility for them; have each member of the governing body attend accredited cybersecurity training and train all your staff regularly; establish permanent means of contact and allocate the resources the measures need; and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying you and entering you in the register.

Appoint a deputy general manager or equivalent as Chief Information Security Officer over that unit, and have that officer report the prior year's overall information-security performance to the board of directors annually and report a material information-security problem promptly when it arises.