Light
Dark
System
Log In
Loading...
Compare / EASA/
Incorporated Amendments
/
Compare & Highlight Differences
Appendix II -- Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0
Available versions for ERULES-1963177438-21667
ED Decision 2023/009/R
found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)
ED Decision 2025/014/R
found in: Information Security (2023/203 and 2022/1645) Part-IS (Dec 2025)
From
Information Securi... (Dec 2025)
Information Securi... (Jun 2024)
From section
To
Information Securi... (Dec 2025)
Information Securi... (Jun 2024)
To section
No visible text changes
0 removals
0 additions
View
Rich
Plain
Sync scrolling
Share
From
Show details
Hide details
To
Show details
Hide details
Version
Show side by side
Appendix II — Main tasks stemming from the implementation of Part-IS, including mapping to NIST CSF 1.1 competencies and ISO/IEC 27001 clauses and controls ED Decision 2023/009/R <table border="1" cellpadding="0" cellspacing="0" width="643"> <thead> <tr> <td rowspan="4" width="142"> <p>Part-IS main task</p> </td> <td width="85"> <p>Activity type</p> </td> <td colspan="6" width="416"> <p>Reference</p> </td> </tr> <tr> <td rowspan="3" width="85"> <p>Management,<br/> Operational</p> </td> <td rowspan="3" width="112"> <p>Part-IS</p> </td> <td colspan="2" width="123"> <p>NIST CSF Version 1.1</p> </td> <td colspan="3" width="181"> <p>ISO/IEC 27001</p> </td> </tr> <tr> <td rowspan="2" width="62"> <p>Function</p> </td> <td rowspan="2" width="60"> <p>Category</p> </td> <td rowspan="2" width="68"> <p>Paragraph Clause</p> </td> <td colspan="2" width="113"> <p>Annex A Control </p> </td> </tr> <tr> <td width="57"> <p>:2013</p> </td> <td valign="top" width="57"> <p>:2022</p> </td> </tr> </thead> <tr> <td width="142"> <p>Establish and operate an information security management system (ISMS)</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><br/> <a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RM</p> </td> <td width="68"> <p>4<br/> 6.1.1</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Establish the scope of the ISMS according to Part-IS requirements</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><br/> <a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a>(a)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.BE-2</p> <p>ID.BE-4</p> <p>ID.AM-5</p> </td> <td width="68"> <p>4.3</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Implement and maintain an information security policy</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><br/> <a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(1)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.GV-1</p> </td> <td width="68"> <p>5.2</p> </td> <td width="57"> <p>A5.1</p> </td> <td width="57"> <p>A5.1</p> </td> </tr> <tr> <td width="142"> <p>Identify and review information security risks</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(2)<br/> <a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a></p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.GV-4<br/> ID.RA</p> </td> <td width="68"> <p>6.1.2<br/> 8.1<br/> 8.2</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Implement information security risk treatment measures</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(3)<br/> <a href="#_DxCrossRefBm1193569694">IS.D.OR.210</a></p> </td> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.PT</p> </td> <td width="68"> <p>6.1.3<br/> 8.1<br/> 8.3</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Implement measures to detect information security events and identify those related to aviation safety</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(5)</p> <p><a href="#_DxCrossRefBm1193569692">IS.D.OR.220</a></p> </td> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.AE-3<br/> DE.CM-1<br/> DE.CM-2<br/> DE.CM-3</p> </td> <td width="68"> </td> <td width="57"> <p>A11.1.2<br/> A12.4.1<br/> A12.4.3<br/> A16.1.7</p> </td> <td width="57"> <p>A7.2</p> <p>A8.15</p> <p>A5.28</p> </td> </tr> <tr> <td width="142"> <p>Implement measures that have been notified by the competent authority</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(6)</p> </td> <td width="60"> </td> <td width="68"> <p>10.1</p> </td> <td width="57"> <p>A6.1.3</p> </td> <td width="57"> <p>A5.5</p> </td> </tr> <tr> <td width="142"> <p>Take appropriate remedial actions to address findings notified by the competent authority (non-compliances)</p> </td> <td width="85"> <p>Both</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(7)</p> <p><a href="#_DxCrossRefBm1193569691">IS.D.OR.225</a></p> </td> <td width="60"> </td> <td width="68"> <p>10.1</p> </td> <td width="57"> <p>A6.1.3 </p> </td> <td width="57"> <p>A5.5</p> </td> </tr> <tr> <td width="142"> <p>Implement an external information security reporting scheme </p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(8)<br/> <a href="#_DxCrossRefBm1193569509">IS.D.OR.230</a></p> </td> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.CO-2<br/> RS.CO-3<br/> RS.CO-4<br/> RS.CO-5</p> </td> <td width="68"> <p>7.4</p> </td> <td width="57"> <p>A6.1.3</p> <p>A16.1.2<br/> A16.1.3</p> </td> <td width="57"> <p>A5.5</p> <p>A6.8</p> </td> </tr> <tr> <td width="142"> <p>Monitor compliance with this Regulation and report findings to top management</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(12)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.GV-3</p> </td> <td width="68"> <p>9.2</p> </td> <td width="57"> <p>A18.2.1<br/> A18.2.2</p> </td> <td width="57"> <p>A5.35</p> <p>A5.36</p> </td> </tr> <tr> <td width="142"> <p>Protect confidentiality of exchanged information</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(13)</p> </td> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.DS-1<br/> PR.DS-2</p> </td> <td width="68"> </td> <td width="57"> <p>A8.2.2<br/> A13.2</p> </td> <td width="57"> <p>A5.13</p> <p>A5.14</p> </td> </tr> <tr> <td rowspan="5" width="142"> <p>Implement and maintain a continuous improvement process to measure the effectiveness and maturity of the ISMS and strive to improve it</p> </td> <td rowspan="5" width="85"> <p>Management</p> </td> <td rowspan="5" width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(b)</p> <p><a href="#_DxCrossRefBm1193569685">IS.D.OR.260</a></p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RA-6<br/> ID.SC-4</p> </td> <td rowspan="5" width="68"> <p>4.4<br/> 9.1<br/> 9.3<br/> 10.1<br/> 10.2</p> </td> <td rowspan="5" width="57"> <p>A5.1.2<br/> A16.1.7<br/> A17.1.3<br/> A18.2.1</p> </td> <td rowspan="5" width="57"> <p>A5.1</p> <p>A5.28</p> <p>A5.29</p> <p>A5.35</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.IP-7<br/> PR.IP-10</p> </td> </tr> <tr> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.DP-5</p> </td> </tr> <tr> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.MI-3<br/> RS.IM-2</p> </td> </tr> <tr> <td width="62"> <p>RECOVER</p> </td> <td width="60"> <p>RC.IM-2</p> </td> </tr> <tr> <td rowspan="4" width="142"> <p>Document and maintain all key processes, procedures, roles and responsibilities</p> </td> <td rowspan="4" width="85"> <p>Management</p> </td> <td rowspan="4" width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(c)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-6<br/> ID.GV-4<br/> ID.RM-1<br/> ID.SC-1<br/> ID.SC-2</p> </td> <td rowspan="4" width="68"> <p>4.2<br/> 5.2<br/> 5.3</p> </td> <td rowspan="4" width="57"> <p>A5.1<br/> A6.1.1</p> </td> <td rowspan="4" width="57"> <p>A5.1</p> <p>A5.2</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AT-2<br/> PR.AT-4<br/> PR.AT-5<br/> PR.IP-12</p> </td> </tr> <tr> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.DP-1</p> </td> </tr> <tr> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.CO-1<br/> RS.AN-5</p> </td> </tr> <tr> <td width="142"> <p>Identify all elements which could be exposed to information security risks</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a>(a)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-1<br/> ID.AM-2<br/> ID.AM-4<br/> ID.AM-5</p> </td> <td width="68"> <p>4.3</p> </td> <td width="57"> <p> A8.1.1</p> </td> <td width="57"> <p>A5.9</p> </td> </tr> <tr> <td width="142"> <p>Identify the interfaces with other organisations which could result in exposure to information security risks</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a>(b)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.BE-1<br/> ID.BE-2<br/> ID.BE-4<br/> ID.BE-5</p> </td> <td width="68"> <p>4.3</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Identify information security risks and assign a risk level</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a>(c)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RA-1<br/> ID.RA-2<br/> ID.RA-3<br/> ID.RA-4<br/> ID.RA-5</p> </td> <td width="68"> <p>6.1.2</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td width="142"> <p>Review and update the risk assessment based on certain criteria</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569684">IS.D.OR.205</a>(d)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RM</p> </td> <td width="68"> <p>8.2</p> </td> <td width="57"> </td> <td width="57"> <p>A5.7</p> </td> </tr> <tr> <td width="142"> <p>Develop and implement measures to address risks and verify their effectiveness</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569694">IS.D.OR.210</a>(a)</p> </td> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.IP<br/> PR.PT</p> </td> <td width="68"> <p>6.1.3<br/> 8.3</p> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Communicate the outcome of the risk assessment to management, other personnel and other organisations sharing an interface</p> </td> <td rowspan="2" width="85"> <p>Operational</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569694">IS.D.OR.210</a>(b)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-3<br/> ID.BE-1<br/> ID.BE-2<br/> ID.BE-4<br/> ID.RM-3<br/> ID.SC-3</p> </td> <td rowspan="2" width="68"> <p>8.1</p> </td> <td rowspan="2" width="57"> </td> <td rowspan="2" width="57"> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.IP-7</p> </td> </tr> <tr> <td width="142"> <p>Establish an internal information security reporting scheme to enable the collection and evaluation of information security events from personnel </p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569683">IS.D.OR.200</a>(a)(4)<br/> <a href="#_DxCrossRefBm1193569693">IS.D.OR.215</a>(a)<br/> <a href="#_DxCrossRefBm1193569693">IS.D.OR.215</a>(e)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-3</p> </td> <td width="68"> <p>7.4 </p> </td> <td width="57"> <p>A16.1.1</p> <p>A16.1.2 </p> </td> <td width="57"> <p>A5.28</p> <p>A6.8</p> </td> </tr> <tr> <td width="142"> <p>Ensure that contracted organisations report information security events</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569693">IS.D.OR.215</a>(c)</p> </td> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.CO-2<br/> RS.CO-4</p> </td> <td width="68"> <p>7.4 </p> </td> <td width="57"> <p> A15.1.1</p> <p>A16.1.2</p> </td> <td width="57"> <p>A5.19</p> <p>A6.8</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Analyse internally reported occurrences to identify information security events, incidents, and vulnerabilities </p> </td> <td rowspan="2" width="85"> <p>Operational</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569693">IS.D.OR.215</a>(b)(1)-(b)(3) </p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RA-1</p> </td> <td rowspan="2" width="68"> </td> <td rowspan="2" width="57"> <p>A12.6.1</p> <p>A16.1.1</p> <p>A16.1.4 </p> </td> <td rowspan="2" width="57"> <p>A8.8</p> <p>A5.24</p> <p>A5.25</p> </td> </tr> <tr> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.AE-2<br/> DE.AE-3<br/> DE.AE-5</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Implement measures to detect in processes and operations information security events which may have a potential impact on aviation safety</p> </td> <td rowspan="2" width="85"> <p>Operational</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569692">IS.D.OR.220</a>(a)</p> </td> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.AE<br/> DE.CM</p> <p>DE.DP</p> </td> <td rowspan="2" width="68"> </td> <td rowspan="2" width="57"> <p>A11.1.2</p> <p>A12.4.1</p> <p>A12.6.1</p> <p>A16.1.1</p> <p>A16.1.2</p> <p>A16.1.3</p> <p>A16.1.4</p> <p>A16.1.5</p> </td> <td rowspan="2" width="57"> <p>A7.2</p> <p>A8.8</p> <p>A8.15</p> <p>A8.16</p> <p>A5.24</p> <p>A5.25</p> <p>A5.26</p> <p>A6.8</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.PT-1</p> </td> </tr> <tr> <td width="142"> <p>Implement measures to respond to information security events that may cause an information security incident</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569692">IS.D.OR.220</a>(b)</p> </td> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.RP<br/> RS.AN<br/> RS.MI</p> </td> <td width="68"> </td> <td width="57"> <p> A16.1.5</p> </td> <td width="57"> <p>A5.26</p> </td> </tr> <tr> <td width="142"> <p>Cooperate on investigations with other organisations that contribute to the information security of its own activities </p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569693">IS.D.OR.215</a>(d)</p> </td> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.AN-3</p> <p>RS.AN-5</p> </td> <td width="68"> </td> <td width="57"> <p> A15.1.2</p> <p>A15.1.3</p> <p>A16.1.7</p> </td> <td width="57"> <p>A5.20</p> <p>A5.21</p> <p>A5.28</p> </td> </tr> <tr> <td width="142"> <p>Implement measures to recover from information security incidents</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569692">IS.D.OR.220</a>(c)</p> </td> <td width="62"> <p>RECOVER</p> </td> <td width="60"> <p>RC.RP-1<br/> RC.IM-1</p> </td> <td width="68"> </td> <td width="57"> <p> A16.1.5</p> <p>A16.1.6</p> </td> <td width="57"> <p>A5.26</p> <p>A5.27</p> </td> </tr> <tr> <td width="142"> <p>Manage risks associated with contracted activities with regard to the management of information security</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569690">IS.D.OR.235</a></p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.SC-1<br/> ID.SC-2</p> </td> <td width="68"> </td> <td width="57"> <p>A15.1 A15.2</p> </td> <td width="57"> <p>A5.19</p> <p>A5.20</p> <p>A5.21</p> <p>A5.22</p> </td> </tr> <tr> <td width="142"> <p>Create and maintain a process to ensure that there is sufficient personnel to perform all activities regarding information security management</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(f)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-5<br/> ID.AM-6<br/> ID.GV-2</p> </td> <td width="68"> <p>7.1</p> </td> <td width="57"> <p> A6.1.1 </p> </td> <td width="57"> <p>A5.2</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Create and maintain a process to ensure that the personnel have the necessary competence for activities regarding information security management</p> </td> <td rowspan="2" width="85"> <p>Management</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(g)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-5<br/> ID.AM-6</p> </td> <td rowspan="2" width="68"> <p>7.2</p> </td> <td rowspan="2" width="57"> <p>A7.2.2</p> </td> <td rowspan="2" width="57"> <p>A6.3</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AT-1</p> </td> </tr> <tr> <td width="142"> <p>Create and maintain a process to ensure that the personnel acknowledge the responsibilities associated with the assigned roles and tasks</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(h)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.GV-2<br/> ID.GV-3</p> </td> <td width="68"> <p>7.3<br/> 7.4</p> </td> <td width="57"> <p>A7.1.2</p> </td> <td width="57"> <p>A6.2</p> </td> </tr> <tr> <td width="142"> <p>Verify the identity and trustworthiness of personnel who have access to information systems</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(i)</p> </td> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AC-6<br/> PR.IP-11</p> </td> <td width="68"> <p>7.1</p> </td> <td width="57"> <p>A7.1.1</p> </td> <td width="57"> <p>A6.1</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Archive, protect and retain records and ensure they are traceable for a specified time</p> </td> <td rowspan="2" width="85"> <p>Operational</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569688">IS.D.OR.245</a></p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.RA-4</p> </td> <td rowspan="2" width="68"> <p> 7.5</p> </td> <td rowspan="2" width="57"> <p>A8.2.2</p> <p>A8.2.3</p> <p>A11.1.3</p> <p>A11.1.4</p> <p>A12.1.3</p> <p>A12.3.1</p> <p>A12.4.1</p> <p>A12.4.2</p> <p>A12.4.3</p> </td> <td rowspan="2" width="57"> <p>A5.10</p> <p>A5.13</p> <p>A7.3</p> <p>A7.5</p> <p>A8.6</p> <p>A8.10</p> <p>A8.13</p> <p>A8.15</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AC-2<br/> PR.AC-3<br/> PR.AC-4<br/> PR.DS-1<br/> PR.DS-4<br/> PR.DS-5<br/> PR.DS-6<br/> PR.IP-4<br/> PR.IP-6<br/> PR.PT-1</p> </td> </tr> <tr> <td width="142"> <p>Correct non-compliance findings upon notification by the competent authority within the period agreed with the competent authority</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569691">IS.D.OR.225</a></p> </td> <td width="60"> </td> <td width="68"> <p> 10.1</p> </td> <td width="57"> <p>A18.1.1</p> <p>A18.2</p> </td> <td width="57"> <p>A5.31</p> <p>A5.35</p> <p>A5.36</p> </td> </tr> <tr> <td width="142"> <p>Implement an information security reporting system in accordance with Regulation (EU) No 376/2014</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569509">IS.D.OR.230</a>(a)</p> </td> <td width="60"> </td> <td width="68"> </td> <td width="57"> </td> <td width="57"> </td> </tr> <tr> <td rowspan="3" width="142"> <p>Report information security incidents or vulnerabilities to the competent authority and, under certain conditions, to others</p> </td> <td rowspan="3" width="85"> <p>Operational</p> </td> <td rowspan="3" width="112"> <p><a href="#_DxCrossRefBm1193569509">IS.D.OR.230</a>(b)<br/> <a href="#_DxCrossRefBm1193569509">IS.D.OR.230</a>(c)</p> </td> <td width="62"> <p>DETECT</p> </td> <td width="60"> <p>DE.DP-3</p> </td> <td rowspan="3" width="68"> <p> 7.4</p> </td> <td rowspan="3" width="57"> <p>A16.1.1</p> <p>A16.1.2</p> <p>A16.1.3 </p> </td> <td rowspan="3" width="57"> <p>A5.24</p> <p>A6.8</p> </td> </tr> <tr> <td width="62"> <p>RESPOND</p> </td> <td width="60"> <p>RS.CO-2<br/> RS.CO-3<br/> RS.CO-4<br/> RS.CO-5</p> </td> </tr> <tr> <td width="62"> <p>RECOVER</p> </td> <td width="60"> <p>RC.CO-3</p> </td> </tr> <tr> <td width="142"> <p>Regularly assess the effectiveness and maturity of the ISMS</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569685">IS.D.OR.260</a>(a)</p> </td> <td width="60"> </td> <td width="68"> <p>9</p> </td> <td width="57"> <p>A5.1.2</p> <p>A12.7.1</p> <p>A16.1.6</p> </td> <td width="57"> <p>A5.1</p> <p>A5.27</p> <p>A8.34</p> </td> </tr> <tr> <td width="142"> <p>Take actions to improve the ISMS if required. Reassess the ISMS elements affected by the implemented measures.</p> </td> <td width="85"> <p>Operational</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569685">IS.D.OR.260</a>(b)</p> </td> <td width="60"> </td> <td width="68"> <p>10</p> </td> <td width="57"> <p> A5.1.2 </p> </td> <td width="57"> <p>A5.1</p> </td> </tr> <tr> <td width="142"> <p>Ensure accessibility of the competent authority to the contracted organisation</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569690">IS.D.OR.235</a>(b)</p> </td> <td width="60"> </td> <td width="68"> <p> 9.3</p> </td> <td width="57"> <p>A6.1.3</p> <p>A15.1</p> <p>A15.2</p> </td> <td width="57"> <p>A5.5</p> <p>A5.20</p> <p>A5.22</p> </td> </tr> <tr> <td width="142"> <p>Top management ensures that all necessary resources are available to comply with the Regulation</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(a)(1)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-5<br/> ID.AM-6</p> </td> <td width="68"> <p>7.1 </p> </td> <td width="57"> <p> A6.1.1</p> </td> <td width="57"> <p>A5.2</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Top management establishes and promotes the information security policy and demonstrates a basic understanding of the Regulation</p> </td> <td rowspan="2" width="85"> <p>Management</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(a)(2)&(a)(3)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.GV-1</p> </td> <td rowspan="2" width="68"> <p>5.1</p> <p>5.2</p> <p>7.4</p> </td> <td rowspan="2" width="57"> <p>A5.1.1</p> <p>A7.2.1</p> <p>A7.2.2 </p> </td> <td rowspan="2" width="57"> <p>A5.1</p> <p>A5.4</p> <p>A6.3</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AT-1</p> <p>PR.AT-4</p> </td> </tr> <tr> <td rowspan="2" width="142"> <p>Appoint a responsible person or a group of persons with appropriate knowledge to manage compliance with the Regulation</p> </td> <td rowspan="2" width="85"> <p>Management</p> </td> <td rowspan="2" width="112"> <p><a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(b)<br/> <a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(c)<br/> <a href="#_DxCrossRefBm1193569689">IS.D.OR.240</a>(d)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-6<br/> ID.GV-2</p> </td> <td rowspan="2" width="68"> <p> 7.1</p> <p>7.2</p> </td> <td rowspan="2" width="57"> <p> A6.1.1</p> <p>A7.2.1</p> <p>A7.2.2 </p> </td> <td rowspan="2" width="57"> <p>A5.2</p> <p>A5.4</p> <p>A6.3</p> </td> </tr> <tr> <td width="62"> <p>PROTECT</p> </td> <td width="60"> <p>PR.AT-1<br/> PR.AT-4</p> </td> </tr> <tr> <td width="142"> <p>Create and maintain an information security management manual (ISMM)</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569687">IS.D.OR.250</a></p> </td> <td width="60"> </td> <td width="68"> <p>7.5.1 </p> </td> <td width="57"> <p>A6.1.3</p> <p>A12.1.1 </p> </td> <td width="57"> <p>A5.5</p> <p>A5.37</p> </td> </tr> <tr> <td width="142"> <p>Develop a procedure on how to notify the competent authority upon changes to the ISMS</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569686">IS.D.OR.255</a>(a)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-3</p> </td> <td width="68"> <p> 7.4</p> <p>7.5.1 </p> </td> <td width="57"> <p>A6.1.3</p> <p>A13.2.1</p> <p>A13.2.2 </p> </td> <td width="57"> <p>A5.5</p> <p>A5.14</p> </td> </tr> <tr> <td width="142"> <p>Manage changes to the ISMS and notify the competent authority and/or request for approval of changes</p> </td> <td width="85"> <p>Management</p> </td> <td width="112"> <p><a href="#_DxCrossRefBm1193569686">IS.D.OR.255</a>(a)<br/> <a href="#_DxCrossRefBm1193569686">IS.D.OR.255</a>(b)</p> </td> <td width="62"> <p>IDENTIFY</p> </td> <td width="60"> <p>ID.AM-3</p> </td> <td width="68"> <p>7.4 </p> </td> <td width="57"> <p>A6.1.3</p> <p>A13.2.1</p> <p>A13.2.2 </p> </td> <td width="57"> <p>A5.5</p> <p>A5.14</p> </td> </tr> </table>
##### Appendix II — Main tasks stemming from the implementation of Part-IS mapped to the EU e-CF and the NIST CSF 2.0 *ED Decision 2025/014/R* <table bgcolor="#d9d9d9" cellpadding="7" cellspacing="0"> <col/> <col/> <col/> <col/> <col/> <thead> <tr valign="top"> <td bgcolor="#808080" rowspan="4"><p> <b>Part-IS main task</b></p> </td> <td bgcolor="#808080"><p> <b>Activity type</b></p> </td> <td bgcolor="#808080" colspan="3"><p> <b>Reference</b></p> </td> </tr> <tr valign="top"> <td bgcolor="#808080" rowspan="3"><p> <b>Management,<br/> Operational</b></p> </td> <td bgcolor="#808080" rowspan="3"><p> <b>Part-IS</b></p> </td> <td bgcolor="#808080"><p> <b>EU e-CF </b> </p> </td> <td bgcolor="#808080"><p> <b>NIST CSF 2.0</b></p> </td> </tr> <tr valign="top"> <td bgcolor="#808080" rowspan="2"><p> <b>Competence areas & skills</b></p> </td> <td bgcolor="#808080" rowspan="2"><p> <b>Functions & categories</b></p> </td> </tr> </thead> <tbody> <tr valign="top"> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Establish and operate an information security management system (ISMS)</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335390">IS.D.OR.200</a></u>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV – Govern</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Establish the scope of the ISMS in accordance with Part-IS requirements</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1291535054">IS.D.OR.205</a></u>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RM – Risk Management Strategy;<br/> ID.AM – Asset Management</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement and maintain an information security policy</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> IS.D.OR.200(a)(1)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.PO – Policy</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Identify and review information security risks</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(2)<br/> <a href="#_DxCrossRefBm1291535054">IS.D.OR.205</a></p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.SC – Cybersecurity Supply Chain Risk Management;<br/> ID.RA – Risk Assessment;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement information security risk treatment measures</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(3)<br/> <u><a href="#_DxCrossRefBm1291535064">IS.D.OR.210</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ID.RA – Risk Assessment</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Set up measures to detect information security events, identify those that may develop to incidents with a potential impact on aviation safety, and respond to, and recover from, such incidents</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(5)<br/> <u><a href="#_DxCrossRefBm1291535062">IS.D.OR.220</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> DE – Detect;<br/> RE – Respond;<br/> RC – Recover;<br/> PR – Protect (as per Risk Assessment)</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement measures that have been notified by the competent authority</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(6)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Take appropriate remedial actions to address findings notified by the competent authority (non-compliances)</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Both</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(7)<br/> <u><a href="#_DxCrossRefBm1291535061">IS.D.OR.225</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement an external information security reporting scheme </b> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(8)<br/> <u><a href="#_DxCrossRefBm1626335206">IS.D.OR.230</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> RS.CO – Incident Response Reporting and Communication;<br/> RC.CO – Incident Recovery Communication</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Monitor compliance with this Regulation and report findings to top management</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(12)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities and Authorities;<br/> GV.RM – Risk Management;<br/> GV.OV – Oversight</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Protect confidentiality of exchanged information</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(13)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Information Security Management (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> PR.DS – Data Security;<br/> Other PR – Protect categories as applicable</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement and maintain a continuous improvement process to measure the effectiveness and maturity of the ISMS and strive to improve it</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(b)<br/> <u><a href="#_DxCrossRefBm1626335393">IS.D.OR.260</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Information Security Management (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OV – Oversight;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Document and maintain all key processes, procedures, roles and responsibilities</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(c)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities and Authorities;<br/> Other functions and categories as applicable</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Identify all elements which could be exposed to information security risks</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> IS.D.OR.205(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ID.AM – Asset Management</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Identify the interfaces with other organisations which could result in exposure to information security risks</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535054">IS.D.OR.205</a>(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02), Business Change Management (E.07)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ID.AM – Asset Management;<br/> GV.SC – Cybersecurity Supply Chain Risk Management</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Identify information security risks and assign a risk level</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535054">IS.D.OR.205</a>(c)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RM – Risk Management Strategy;<br/> ID.RA – Risk Assessment</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Review and update the risk assessment based on certain criteria</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535054">IS.D.OR.205</a>(d)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RM – Risk Management Strategy;<br/> GV.PO – Policy;<br/> GV.OV – Oversight;<br/> GV.SC – Cybersecurity Supply Chain Risk Management;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Develop and implement measures to address risks and verify their effectiveness</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535064">IS.D.OR.210</a>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RM – Risk Management Strategy;<br/> ID.RA – Risk Assessment</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Communicate the outcome of the risk assessment to management, other personnel and other organisations sharing an interface</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535064">IS.D.OR.210</a>(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Risk Management (E.02), ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RM – Risk Management Strategy;<br/> GV.SC – Cybersecurity Supply Chain Risk Management</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Establish an internal information security reporting scheme to enable the collection and evaluation of information security events from personnel </b> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535053">IS.D.OR.200</a>(a)(4)<br/> <u><a href="#_DxCrossRefBm1626335399">IS.D.OR.215</a></u>(a)<br/> <a href="#_DxCrossRefBm1291535063">IS.D.OR.215</a>(e)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ID.RA – Risk Assessment;<br/> DE.AE – Adverse Event Analysis;<br/> RS.CO – Incident Response Reporting and Communication;<br/> RC.CO – Incident Recovery Communications</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Ensure that contracted organisations report information security events</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535063">IS.D.OR.215</a>(c)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Supplier Relationship Management (E.10)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.SC – Cybersecurity Supply Chain Risk Management;<br/> DE.CM – Continuous Monitoring</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Analyse internally reported occurrences to identify information security events, incidents, and vulnerabilities </b> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535063">IS.D.OR.215</a>(b)(1)–(b)(3)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> DE.AE – Adverse Event Analysis</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement measures to detect in processes and operations information security events which may have a potential impact on aviation safety</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> IS.D.OR.220(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> DE.CM – Continuous Monitoring;<br/> DE.AE – Adverse Event Analysis;<br/> ID.RA – Risk Assessment;<br/> PR – Protect (selection of relevant controls as per Risk Assessment)</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement measures to respond to information security events that may cause an information security incident</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535062">IS.D.OR.220</a>(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> RS.MA – Incident Management;<br/> RS.AN – Incident Analysis;<br/> RS.MI – Incident Mitigation;<br/> RS.CO – Incident Response Reporting and Communication (where applicable);<br/> PR – Protect (selection of relevant controls as per Risk Assessment)</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Cooperate on investigations with other organisations that contribute to the information security of its own activities </b> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535063">IS.D.OR.215</a>(d)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04), Legal Advice and Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> DE.CM – Continuous Monitoring;<br/> RS.CO – Incident Response Reporting and Communication;<br/> RC.CO – Incident Recovery Communication</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement measures to recover from information security incidents</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535062">IS.D.OR.220</a>(c)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> RC.RP – Incident Recovery Plan Execution;<br/> RC.CO – Incident Recovery Communication;<br/> PR – Protect (selection of relevant controls as per Risk Assessment)</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Manage risks associated with contracted activities with regard to the management of information security</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335396">IS.D.OR.235</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Supplier Relationship Management (E.10)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.SC – Cybersecurity Supply Chain Risk Management</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Create and maintain a process to ensure that there is sufficient personnel to perform all activities regarding information security management</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335395">IS.D.OR.240</a></u>(f)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Personnel Development (D.11)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities, and Authorities</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Create and maintain a process to ensure that the personnel have the necessary competence for activities regarding information security management</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(g)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Personnel Development (D.11)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities, and Authorities;<br/> PR.AT – Awareness and Training (02)</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Create and maintain a process to ensure that the personnel acknowledge the responsibilities associated with the assigned roles and tasks</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(h)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Personnel Development (D.11)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities, and Authorities</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Verify the identity and trustworthiness of personnel who have access to information systems</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(i)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities, and Authorities;<br/> GV.PO – Policy;<br/> PR.AA – entity Management, Authentication, and Access Control</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Archive, protect and retain records and ensure they are traceable for a specified time</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335394">IS.D.OR.245</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OV – Oversight;<br/> GV.RR – Roles, Responsibilities, and Authorities;<br/> PR.DS – Data Security;<br/> PR.PS – Platform Security;<br/> RS.AN – Incident Analysis;<br/> GV.SC – Cybersecurity Supply Chain Risk Management;<br/> ID.RA – Risk Assessment</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Correct non-compliance findings upon notification by the competent authority within the period agreed with the competent authority</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535061">IS.D.OR.225</a></p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Implement an information security reporting system in accordance with <u><a href="http://data.europa.eu/eli/reg/2014/376/oj">Regulation (EU) No 376/2014</a></u></b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291534886">IS.D.OR.230</a>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Report information security incidents or vulnerabilities to the competent authority and, under certain conditions, to others</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291534886">IS.D.OR.230</a>(b)<br/> <a href="#_DxCrossRefBm1291534886">IS.D.OR.230</a>(c)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Incident Management (C.04)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OC – Organisational Context;<br/> RS.CO – Incident Response Reporting and Communication;<br/> RC.CO – Incident Recovery Communications</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Regularly assess the effectiveness and maturity of the ISMS</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535055">IS.D.OR.260</a>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OV – Oversight;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Take actions to improve the ISMS if required. Reassess the ISMS elements affected by the implemented measures.</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Operational</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535055">IS.D.OR.260</a>(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OV – Oversight;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Ensure accessibility of the competent authority to the contracted organisation</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535060">IS.D.OR.235</a>(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OC – Organisational Context</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Top management ensures that all necessary resources are available to comply with the Regulation</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(a)(1)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.RR – Roles, Responsibilities, and Authorities</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Top management establishes and promotes the information security policy and demonstrates a basic understanding of the Regulation</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(a)(2)<br/> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(a)(3)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.PO – Policy;<br/> GV.PO RR – Roles, Responsibilities, and Authorities</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Appoint a responsible person or a group of persons with appropriate knowledge to manage compliance with the Regulation</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(b)<br/> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(c)<br/> <a href="#_DxCrossRefBm1291535059">IS.D.OR.240</a>(d)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.PO RR – Roles, Responsibilities, and Authorities</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Create and maintain an information security management manual (ISMM)</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335392">IS.D.OR.250</a></u></p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> <td bgcolor="#d9d9d9"><p align="left"> <br/> </p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Develop a procedure on how to notify the competent authority upon changes to the ISMS</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> <u><a href="#_DxCrossRefBm1626335391">IS.D.OR.255</a></u>(a)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> Compliance (E.09)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OC – Organisational Context;<br/> ID.RA – Risk Assessment;<br/> ID.IM – Improvement</p> </td> </tr> <tr valign="top"> <td bgcolor="#808080"><p align="left"> <b>Manage changes to the ISMS and notify the competent authority and/or request for approval of changes</b></p> </td> <td bgcolor="#d9d9d9"><p align="left"> Management</p> </td> <td bgcolor="#d9d9d9"><p align="left"> IS.D.OR.255(a)<br/> IS.D.OR.255(b)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> ISM (E.08), Process Improvements (E.05)</p> </td> <td bgcolor="#d9d9d9"><p align="left"> GV.OC – Organisational Context;<br/> ID.RA – Risk Assessment;<br/> ID.IM – Improvement</p> </td> </tr> </tbody> </table>