[non-validated] Management-Approved Roles and Responsibilities Documentation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have documented roles and responsibilities for cybersecurity functions been formally approved by management bodies and reviewed at least annually, as required for NIS2-relevant entities?
Explanation
[non-validated] Have management bodies formally approved documented cybersecurity roles, responsibilities, and authorities, with annual review evidence as required for NIS2-relevant entities?
Criterion and evidence
Verifies management-approved documentation of cybersecurity roles/responsibilities per Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g), including annual review evidence per Annex 1.1.2. Assessment requires documented proof of approval date and review cycle; overdue reviews or missing documentation constitute failure.
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Roles, Responsibilities, Authorities, and Security Policy. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What constitutes sufficient evidence for this requirement?
Formal policy document or board minutes showing management approval date, clear assignment of cybersecurity roles/responsibilities, and evidence of annual review (e.g., signed revision dates). ENISA Technical Guidance v1.0 section 4.1 specifies documented evidence as mandatory for demonstrating compliance with Article 21 obligations.
What does not satisfy this criterion?
Undocumented assertions, generic organizational charts without role specifics, policies lacking approval signatures, or review schedules exceeding 12 months without evidence of actual review. Overdue reviews default to failed status per ENISA Mapping Document section 'Role Implementation'.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures (Version 1.0)
Mapping NIS2 Obligations with ECSF Role Profiles