NIST CSF 2.0, IdentifyID.IM-01

Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.

Undergo a security audit for certification of your information system every three years, performed by ARTCI or by an ARTCI-accredited Prestataire d'Audit de Sécurité des Systèmes d'Information (PASSI).

Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.

Give the cybersecurity authority confidential access, on request, to the arrangements you have made to secure your network, and submit your network to a security and integrity inspection the authority conducts or commissions, at your own expense.

Submit your information systems, at your own cost, to a control the cybersecurity authority conducts to verify their security level and your compliance with security rules.

Conduct regular cybersecurity risk assessments and impact analyses, participate in the Administration's annual National Cybersecurity Risk Survey and supply the information it requests, and obtain and renew a cyber audit certificate and a cybersecurity inspection-and-evaluation certificate from the Administration, taking appropriate corrective action within the time the Administration sets on any gap the audit or inspection finds.

Where a threshold decree brings you into scope, have a cybersecurity audit carried out by a provider ANSSI has qualified (a PASSI), covering the security and location of the data you host (directly or through a third party) and your own security.

Have your information system's security audited at least once every three years, and attach a copy of the audit report to your annual internal-control report.

Comply with cybersecurity standards the DTO issues, submit to its periodic or ad hoc audits, inspections and penetration testing, and conduct and submit periodic cybersecurity assessments of the infrastructure's risk, vulnerability and preparedness.

Submit to a Director-ordered audit of your critical information infrastructure, at your own cost and no more than once every two years, where the Director has reason to believe you have not complied with the Act or with a technical standard applicable to you, or that information you supplied is false, misleading, or incomplete.

If designated an essential entity, obtain a certificate of compliance with the Montenegrin standard MEST ISO/IEC 27001 from an accredited body within 30 months of 5 December 2024, and request a periodic re-verification from that body afterward (Article 18(4) to (6) and Article 73).

Evaluate and revise your security systems as technology evolves, and make the changes your security practices, measures, and techniques need.

Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight.

At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.

By April 15 of each year, submit to the Superintendent electronically either a written certification that you materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections you did not materially comply with and a remediation timeline, each signed by your highest-ranking executive and your Chief Information Security Officer.