Publications Office of the EU
Guidelines on assessing DSP and OES compliance with the NISD security requirements
DisplayCustomHeader
MyPortal
dansk
BasketSummary
Web Content Display (Global)
Publication Detail Actions Portlet

Værktøjer

Publication Detail Actions Portlet
 Brugerklassificering
custom-survey-notification
Publication Detail Portlet

Publication detail

Home

Guidelines on assessing DSP and OES compliance with the NISD security requirements

Information security audit and self – assessment/ management frameworks

Metadata for publikationen

According to the NIS Directive Articles 14, 15 and 16, one of the key objectives is to introduce appropriate security measures for operators of essential services (OES) as well as for the digital service providers (DSP) in an effort to achieve a baseline, common level of information security within the European Union (EU) network and information systems. Information security (IS) audits and self–assessment/ management exercises are the two major enablers to achieve this objective. This report presents the steps of an information security audit process for the OES compliance, as well as of a self-assessment/ management framework for the DSP security against the security requirements set by the NIS Directive. In addition, it provides an analysis of the most relevant information security standards and frameworks to support OES and DSP in practicing the above exercises in the most tailored and efficient manner. The report identifies numerous parameters towards the successful conduct of information security audits as well as self-assessment/management. Specifically it:  Proposes an information security audit methodology that could be utilized to facilitate the audit process for OES by the NCA and DSP security self-assessments e;  Provides an indicative guideline (set of questions) accompanied by evidence that could be utilized to facilitate the overall audit process;  Proposes to DSP an indicative list of questions, together with relevant evidence, that could facilitate their self assessment exercises against the security requirements prescribed in article 16(1) of the NIS Directive;  Presents post-audit actions for the NCA with a view to extract benefit and/or knowledge, following an information security audit exercise;  Illustrates all the information security lifecycle phases and highlights key issues in each phase (e.g. scoping and main challenges during the pre-audit/ planning phase); and  Presents a comparison of IS audit and self-assessment/management frameworks and methodologies and their correlation with relevant IS audit standards. Overall, this report is a guidance to national competent authorities in supporting the implementation of the requirements stemming from article 14, 15 and 16 of the Directive.
Vis mere
Vis mindre
ISBN 978-92-9204-264-6
DOI 10.2824/265743
Katalognummer TP-04-18-961-EN-N
PDF
ISSN ISBN 978-92-9204-264-6 DOI 10.2824/265743 Katalognummer TP-04-18-961-EN-N
  • Released on EU publications website:
Publication Viewer

Dokumentvisning

Pop up window annotations