ED Decision 2023/009/R
The organisation should take into account the following criteria when establishing compliance with the objectives contained in point IS.D.OR.205(d):
(a) The risk assessment performed under points IS.D.OR.205(a), (b) and (c) should be reviewed at regular intervals to identify and account for relevant changes. The periodicity at which potential changes have to be evaluated should be determined by the organisation performing the assessment considering the criticality of the assets within the scope of the risk assessment, levels of residual risk of the assets within the scope of the risk assessment and any contractual or regulatory requirements. A higher criticality or level of risk will require more frequent review.
(b) The periodicity of risk assessment reviews should be documented by the organisation and include the justification, date of approval and information about the risk owner.
Loading collections...