IS.I.OR.250 Information security management manual (ISMM)

• Regulation (EU) 2023/203 found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

IS.I.OR.250 Information security management manual (ISMM) Regulation (EU) 2023/203 (a)     The organisation shall make available to the competent authority an information security management manual (ISMM) and, where applicable, any referenced associated manuals and procedures, containing: (1)     a statement signed by the accountable manager confirming that the organisation will at all times work in accordance with this Annex and with the ISMM. If the accountable manager is not the chief executive officer (CEO) of the organisation, then the CEO shall countersign the statement; (2)     the title(s), name(s), duties, accountabilities, responsibilities and authorities of the person or persons defined in point [IS.I.OR.240](#_DxCrossRefBm1193569546)(b) and (c); (3)     the title, name, duties, accountabilities, responsibilities and authority of the common responsible person defined in point [IS.I.OR.240](#_DxCrossRefBm1193569546)(d), if applicable; (4)     the information security policy of the organisation as referred to in point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a)(1); (5)     a general description of the number and categories of staff and of the system in place to plan the availability of staff as required by point [IS.I.OR.240](#_DxCrossRefBm1193569546); (6)     the title(s), name(s), duties, accountabilities, responsibilities and authorities of the key persons responsible for the implementation of point IS.I.OR.200, including the person or persons responsible for the compliance monitoring function referred to in point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a)(12); (7)     an organisation chart showing the associated chains of accountability and responsibility for the persons referred to in points (2) and (6); (8)     the description of the internal reporting scheme referred to in point [IS.I.OR.215](#_DxCrossRefBm1193569550); (9)     the procedures that specify how the organisation ensures compliance with this Part, and in particular: (i)      the documentation referred to in point [IS.I.OR.200](#_DxCrossRefBm1193569541)(c;) (ii)     the procedures that define how the organisation controls any contracted activities as referred to in point [IS.I.OR.200](#_DxCrossRefBm1193569541)(a)(9); (iii)     the ISMM amendment procedure referred to in in point (c); (10)    the details of currently approved alternative means of compliance. (b)     The initial issue of the ISMM shall be approved and a copy shall be retained by the competent authority. The ISMM shall be amended as necessary to remain an up-to-date description of the ISMS of the organisation. A copy of any amendments to the ISMM shall be provided to the competent authority. (c)      Amendments to the ISMM shall be managed in a procedure established by the organisation. Any amendments that are not included within the scope of this procedure and any amendments related to the changes referred to in point [IS.I.OR.255](#_DxCrossRefBm1193569543)(b) shall be approved by the competent authority. (d)     The organisation may integrate the ISMM with other management expositions or manuals it holds, provided there is a clear cross reference that indicates which portions of the management exposition or manual correspond to the different requirements contained in this Annex.