Athena — roomy-mobile/compliance/nis2.md

NIS2 Assessment

Project: Date: Status:


1. Scope

Is this system in scope for NIS2?

  • [ ] Essential entity (Annex I)
  • [ ] Important entity (Annex II)
  • [ ] Out of scope

Sector:


2. Governance (Art. 20)

  • [ ] Management body has approved cybersecurity policy
  • [ ] Cybersecurity training provided to management
  • [ ] Responsible person / CISO designated

3. Risk Management Measures (Art. 21)

3.1 Policies

  • [ ] Information security policy documented
  • [ ] Risk assessment policy in place
  • [ ] Incident handling policy in place
  • [ ] Business continuity / disaster recovery policy in place

3.2 Technical measures

| Measure | Status | Notes | |---------|--------|-------| | Multi-factor authentication | ⬜ | | | Encryption at rest | ⬜ | | | Encryption in transit | ⬜ | | | Vulnerability management / patching | ⬜ | | | Network segmentation | ⬜ | | | Endpoint protection | ⬜ | | | Logging & monitoring (SIEM) | ⬜ | | | Penetration testing | ⬜ | | | Secure SDLC | ⬜ | | | Access control (least privilege) | ⬜ | | | Backup & restore tested | ⬜ | | | Supply chain security | ⬜ | |

3.3 Organisational measures

  • [ ] Asset inventory maintained
  • [ ] Third-party / supplier risk assessed
  • [ ] Security awareness training for all staff
  • [ ] Acceptable use policy

4. Incident Reporting (Art. 23)

Early warning (24h): Notification (72h): Final report (1 month):

Competent authority: CSIRT:


5. Supply Chain Security (Art. 21.2d)

| Supplier | Criticality | Security assessment done? | DPA / SLA in place? | |----------|------------|--------------------------|---------------------| | | | | |


6. Business Continuity (Art. 21.2c)

  • [ ] RTO defined:
  • [ ] RPO defined:
  • [ ] DR plan documented (see processes/disaster-recovery.md)
  • [ ] DR tested:

7. Gaps & Remediation

| Gap | Priority | Owner | Target date | |-----|----------|-------|-------------| | | | | |

Reacties

Nog geen reacties