[non-validated] Documented Risk Management Procedures in Development Lifecycle
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the organization implemented documented risk management procedures that include identifying and mitigating security threats during application development, as required by Directive (EU) 2022/2555 Annex point 2?
Explanation
[non-validated] Has the organization implemented documented risk management procedures that include systematic identification and mitigation of security threats during application development, as required by NIS2 framework? Evidence must demonstrate documented procedures meeting regulatory requirements; missing documentation results in pending assessment.
Criterion and evidence
Verification against Implementing Regulation (EU) 2024/2690 through ENISA Technical Guidance v1.0 Introduction page 11 requirement for documented risk management policy covering threat identification. Evidence period aligns with current regulatory compliance cycle. Acceptable evidence: documented procedures showing systematic threat identification and risk treatment decisions per regulatory provisions. Missing documentation results in 'pending' status.
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Secure Development Lifecycle and Risk Management. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What constitutes sufficient evidence for this requirement?
Complete documented procedures showing systematic threat identification and risk treatment decisions per Implementing Regulation (EU) 2024/2690 as confirmed by ENISA Technical Guidance Introduction page 11. Evidence must demonstrate coverage during development phases. Incomplete documentation (e.g., mentioning risk management without specific threat procedures) fails assessment. Missing documentation results in 'pending' status until provided.
How are regulatory requirements verified without specific methodologies?
Verification focuses on documented procedures meeting regulatory requirements per ENISA guidance, not specific methodologies. Evidence must demonstrate comprehensive threat identification coverage as required by regulation, without mandating particular frameworks. Regulatory text takes precedence over implementation examples in technical sources.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures