NIST CSF 2.0, IdentifyID.RA-06

Apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, built on your own risk analysis, to manage the risks to the system you use in your activities or to provide your service, to prevent or minimise a cyber incident's impact on your service's recipients and on other services, and to prevent, detect or resolve a cyber incident.

Develop measures to address unacceptable risks, implement them in a timely manner, check their continued effectiveness, inform the persons referred to in point IS.D.OR.240(a) and (b) and the other affected personnel of the outcome of the risk assessment, the corresponding threat scenarios and the measures to be implemented, and inform the organizations you share an interface with of any risk you share with them (points IS.D.OR.210(a) and (b)).

Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.D.OR.245).

Develop measures to address unacceptable risks, implement them in a timely manner, check their continued effectiveness, inform the persons referred to in point IS.I.OR.240(a) and (b) and the other affected personnel of the outcome of the risk assessment, the corresponding threat scenarios and the measures to be implemented, and inform the organizations you share an interface with of any risk you share with them (points IS.I.OR.210(a) and (b)).

Keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment, and keep the records of key processes, risks and risk treatment measures, and reported incidents and vulnerabilities for at least 5 years (point IS.I.OR.245).

Establish a risk management framework, perform and document risk assessments, and establish, implement and monitor a risk treatment plan, reviewing the assessment results and the plan at planned intervals and at least annually (points 2.1.1 and 2.1.4).

Address without undue delay the vulnerabilities you identify as critical to your operations, and lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy (points 6.10.2(c) and (e)).

Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.

Identify the risks that threaten the security of the networks and information systems you use to provide your services in the European Union, and take the necessary and proportionate technical and organisational measures to manage those risks, prevent an incident from compromising your networks and systems, and minimise its impact, so as to guarantee the continuity of your services.

In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.

Make those measures sufficient, having regard to best practices and their cost, to give a level of security appropriate to the risk your services present.

Adopt technical and organisational measures adequate and proportionate to the risks facing the network and information systems you use to provide your services, and to minimise the impact of a security incident on your services and on others.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your activities or to provide your services, and to prevent or minimise the impact of an incident on the recipients of your services or on other services.

Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.

Adopt technical, operational and organisational measures adequate and proportionate to the risks facing the network and information systems you use in your activities or in providing your services, and to prevent or minimise the impact of an incident on the recipients of your services and on other services.

Take appropriate and proportionate technical and organisational measures to manage the cyber risks to the security of the electronic communications networks and information systems you use, and to prevent or minimise to the greatest extent possible the impact of a cyber incident on your service recipients and on other services.

Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a security incident on the recipients of your services and on other services.

Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or to provide your services, and act to eliminate or reduce the impact of an incident on the recipients of your services and on other services.

Where you find you are not complying with these measures, take, without undue delay, all necessary, appropriate and proportionate corrective measures.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of incidents on the recipients of your services and on other services (article 19(1)).

Where you find you do not comply with the measures in article 19(2), take, without undue delay, all necessary, appropriate and proportionate corrective measures (article 19(4)).

Implement technical, operational, and organizational measures to manage the cybersecurity risks that may affect your designated critical information infrastructure, and measures to prevent and mitigate the impact of a cybersecurity incident or threat.

Implement technical, operational, and organizational measures to manage cybersecurity risks to your designated critical information infrastructure, and measures to prevent or mitigate the impact of a cybersecurity incident or threat on it.

If you are a digital service provider, identify the risks threatening the security of your own networks and information systems, and take the technical and organizational measures needed to manage those risks, avoid incidents, and minimize their impact, so as to guarantee the continuity of your services.

Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent an incident or limit its effect on the recipients of your services and on other services.

The Department says you must use the results of the risk assessment to inform the design and implementation of, and updates to, your cybersecurity policies, procedures, controls and testing plans, and the assessment must inform and support your decisions on control selection, compensating controls and risk acceptance; it expects you to be able to demonstrate how it did.

The Department says you must maintain documentation sufficient to demonstrate how cybersecurity risks were identified, assessed and addressed through the risk assessment process, including records that link each identified risk to the controls or compensating measures implemented; it says the documentation should also capture any risk you accept, with the justification and any residual risk considerations.

The Department says that when you become aware of a heightened threat environment, one in which cybersecurity risks are significantly elevated and have a high likelihood of impacting your information systems, nonpublic information or operations, you should consider additional steps that may go beyond the minimum requirements of Part 500, to the extent not already required and implemented, depending on your circumstances and operations.

Take appropriate technical, operational and organisational measures to manage the risks to the network and information systems you use in your operations, and to prevent or minimise the impact of an incident on the recipients of your services and on other services, at a level proportionate to your risk exposure, your size and the likelihood and severity of an incident.

Manage risk by identifying assets and risks, analyzing and assessing them, adopting security measures with reasons for any you do not adopt, and reviewing the identified risks at least once a year; have the person named in Section 20(4)(h) of the Act approve the results of the analysis and the proposed measures (§ 5).

As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.

Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.

If you provide a managed service, identify and take appropriate and proportionate measures to manage the risks to the network and information systems you rely on to provide managed services within the United Kingdom, ensuring (having regard to the state of the art) a level of security appropriate to the risk and preventing and minimizing the impact of incidents, and have regard to any relevant guidance from the Information Commission (new regulation 14B).