NIST CSF 2.0, IdentifyID.RA-04

Refer the vulnerability impact analysis to the target of evaluation and the assurance statements contained in the certificate, carry it out in a timeframe appropriate for the exploitability and criticality of the potential vulnerability and, where applicable, perform an attack potential calculation to determine its exploitability, taking the AVA_VAN level of the certificate into account (Article 34(1) and (2)).

If you are an entity within Annex 1 or 2 of Ordonanța de urgență nr. 155/2024 that has not been qualified as essential or important under its Articles 5, 6 and 9 criteria, assess the degree of disruption of each service you provide that falls within those Annexes, using the thresholds in Annex 1 to Order 2/2025, and use the result to complete the registration information (Article 1).

To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.

It reaches you if you hold an EUCC certificate for an ICT product (Article 32). Where your vulnerability impact analysis shows that a vulnerability has a likely impact on the conformity of the ICT product with its certificate, produce a vulnerability impact analysis report that assesses the impact of the vulnerability on the certified ICT product, possible risks associated with the proximity or availability of an attack, whether the vulnerability may be remedied and, where it may, possible resolutions (Article 35(1) and (2)).

Include in the report, where applicable, details about the possible means of exploitation of the vulnerability, and handle that information under appropriate security measures that protect its confidentiality and ensure, where necessary, its limited distribution (Article 35(3)).