Manage

The mission, vision, risk management strategy and objectives of the entity shall be defined and communicated.

The needs and expectations of internal and external stakeholders are understood and reflected in the management of cybersecurity risks.

Legal, regulatory and contractual requirements for cybersecurity are understood and managed.

The critical services of the entity on which external stakeholders depend are identified and reported.

The resilience requirements necessary to support the provision of critical services are defined.

The external services on which the entity depends are identified and reported.

The entity's appetite and risk tolerance are defined, approved, communicated and reviewed regularly.

Cybersecurity risk management processes are included in the entity’s cross-cutting risk management strategy.

The entity shall define its risk management strategy.

The entity shall establish an internal communication channel for sharing cybersecurity risks.

The entity shall define a Cybersecurity Risk Management Policy with methodology to manage those risks.

The management, management and administration bodies understand their functions and responsibilities and promote a culture of cybersecurity, ethics and continuous improvement.

Appropriate and proportionate resources are allocated to cybersecurity strategy, functions, responsibilities and policies.

The cybersecurity functions, responsibilities and authorities shall be defined and communicated to staff, suppliers and stakeholders.

Cybersecurity is covered in human resources management processes.

Cybersecurity management policies are defined on the basis of the entity's context, strategy and priorities.

The Incident Response Plan is defined, communicated, maintained and improved.

The Disaster Recovery Plan is defined, communicated, maintained and improved.

The results of the risk management strategy are analyzed to inform management and adapt the strategy when necessary.

The cybersecurity risk management strategy is regularly reviewed and adapted to organizational requirements and risks.

The performance of cybersecurity risk management shall be assessed and reviewed for the necessary changes.

The supply chain risk management policies and processes are identified, established, evaluated and managed.

The roles and responsibilities of partners, suppliers and customers are defined, communicated and coordinated.

The management of supply chain risks is part of the entity’s cross-cutting processes and risk strategy.

Suppliers shall be periodically evaluated.

The entity is part of the contracts and agreements requirements for managing supply chain risks.

Prior to hiring, due diligence procedures are carried out to reduce risks.

The entity shall assess the cybersecurity risks of the supply chain.

The response and recovery plans are tested with the monitoring of suppliers.

Supply chain practices integrate cybersecurity programs and are monitored throughout the life cycle.

Procedures include arrangements for activities during or after termination of contracts with suppliers or partners.