NIST CSF 2.0, ProtectPR.AT-02

Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.

In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.

Have your management body implement and oversee these measures and attend regular risk-management training; expect it to be liable to your organisation for culpable damage from a breach of that duty under the ordinary rules of company law.

Within three months of this duty's entry into force, have your management body approve the cybersecurity risk-management measures you take to comply with the measures below, supervise their implementation, and ensure every board member receives training and that equivalent training reaches your staff at least annually.

Have your management and governing bodies approve how these measures are implemented and oversee their implementation, see that they attend cybersecurity training, and promote similar training for your employees.

Give every employee and official who uses your ICT resources an initial cybersecurity briefing within one month of registering their user account and a routine briefing at least once a calendar year, and train your ICT staff at least once a year (point 76).

Have your leadership body (Leitungsorgan) approve and oversee these measures and attend, and offer your staff, regular training on recognising and assessing cybersecurity risk and risk-management practice.

Designate a cybersecurity manager and/or security officer who organises your risk assessment and prepares your risk-assessment reports and risk-management plans for approval, and have your management body, head and designated representative complete cybersecurity training at least once every two years.

Have your management body approve these risk-management measures, oversee their implementation, and complete regular training on assessing risk and risk-management practice; expect the body to be held liable for the entity's violation of this duty.

Have your management body approve the risk-management measures and oversee their implementation, have its members follow cybersecurity risk-management training, and offer similar training to your employees on a regular basis; the natural persons composing the management body may be held liable for an infringement of article 19 (article 18).

Make your staff aware of the risks to your network and information systems, have them apply cyber-hygiene practices, and give those whose roles need security expertise regular training (Article 12); keep a written cryptography policy that sets out when cryptography is used and who is responsible for key management (Article 13).

Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.

The Department says your training should ensure all personnel are aware of the risks posed by AI, the procedures you have adopted to mitigate them, and how to respond to AI-enhanced social engineering attacks, and that training for cybersecurity personnel should include how threat actors use AI in social engineering attacks, how AI facilitates and enhances existing types of cyberattacks, and how AI can improve cybersecurity.

Ensure that current copies of the plans, or the relevant portions, are distributed or otherwise accessible, including during a cybersecurity event, to all employees necessary to implement them, and provide relevant training on their roles and responsibilities to all employees responsible for implementing them.

Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.

Have your governing body approve these measures, supervise their implementation and bear responsibility for them; have each member of the governing body attend accredited cybersecurity training and train all your staff regularly; establish permanent means of contact and allocate the resources the measures need; and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying you and entering you in the register.

Have the individuals in your management undergo training on these security measures.

Provide the dedicated unit's personnel at least 15 hours, and other information-technology personnel at least 6 hours, of information-security training annually.