NIST CSF 2.0, GovernGV.RR-02

Register your critical or important information infrastructure with the National Authority for Cybersecurity (AKSK), establish a Computer Security Incident Response Team and a single point of contact for AKSK and other CSIRTs, and implement the technical, organisational and operational risk management measures a Council of Ministers methodology sets for your designated category.

Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.

Have the accountable manager or, for a design organization, the head of the design organization ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.D.OR.240(a) to (c)).

Have the accountable manager ensure that the resources needed to comply are available, establish and promote the information security policy, and appoint a person or group of persons to ensure compliance and to manage the compliance monitoring function (points IS.I.OR.240(a) to (c)).

Maintain a policy on the security of network and information systems that your management bodies approve and review at least annually and when significant incidents or significant changes to operations or risks occur, and have at least one person report directly to your management bodies on network and information system security (Annex points 1.1.1(k), 1.1.2 and 1.2.3).

Keep the members of your management body up to date with sufficient knowledge and skills to understand and assess ICT risk, including through specific training on a regular basis. Unless you are a microenterprise, establish a role, or designate a member of senior management, to monitor the arrangements with ICT third-party service providers (Article 5(3) and (4)).

Unless you are a microenterprise, assign responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, keep ICT risk management, control and internal audit functions segregated, have the framework audited internally on a regular basis by auditors with sufficient knowledge, skills and expertise in ICT risk, and establish a formal follow-up process for critical ICT audit findings (Article 6(4), (6) and (7)).

Designate a qualified staff member as ICT Security Officer (Υ.Α.Σ.Π.Ε.), who manages communications with the National Cybersecurity Authority and coordinates compliance and incident reporting internally, keep a unified cybersecurity policy (an essential entity submits it to the Authority for approval at least annually), and keep an inventory of your information and communication assets ranked by criticality.

Maintain an information-security committee (or, for a non-bank financial institution, have your board of directors perform this function) to validate and approve the security measures your policy adopts.

Designate an information-security officer independent of the IT department, reporting to risk management or directly to general management, with the data and access needed to do the job.

Survey and register every electronic information system, central service and supporting system you use, appoint or designate the person responsible for the security of those systems, classify them into a security category, and apply protective measures proportionate to their risk.

Appoint a member of senior management as Chief Information Security Officer, and develop, implement, communicate to staff and keep records of technical and organisational policies, practices and processes to manage risk to your network and information infrastructure and to prevent, mitigate and remedy a cybersecurity incident.

If you process important data, an official classification this corpus cannot flag against on its own, designate a person responsible for data security and a managing body, and implement that responsibility.

If you provide Internet access service, additionally draft internal security-operation procedures, name the person responsible for network security, and adopt technical and organizational measures against malware contamination and network attacks and intrusions.

At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.

Form a data classification team including your information security and information technology leads, and direct employees to report immediately any breach of this classification scheme, recording it with the corrective action taken.

Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.

As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.

Designate an employee to monitor your compliance with these measures (Article 18(3)).

Name a person responsible for information security and stand up a team dedicated to detecting and responding to security incidents.

If you are part of the Public Administration or the Private Sector at large, rather than one of the specifically named operator categories, also name an internal cybersecurity auditor, adopt an institutional information-security policy, and establish an institutional CSIRT.

Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.

Designate a single point of contact at entity level for information sharing (Article 38(1), point (c)).

Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.

If you are an operator of essential services, a digital service provider or a local government organization using such devices, use them in accordance with the technical security specifications, appoint an Internet of Things Security Officer, keep a register of the devices you use and update it annually, suspend use of a device that presents a risk, and carry out a data protection impact assessment of the related processing (Articles 35, 37(2), 38 and 41(2)).