[non-validated] Post-Incident Roles Review Compliance
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have documented cybersecurity roles and responsibilities been reviewed and updated following any significant incidents or operational changes during the evidence period, as required by Implementing Regulation (EU) 2024/2690 Annex 1.1.2?
Explanation
[non-validated] Management bodies must review and update documented cybersecurity roles and responsibilities following significant incidents or operational changes to maintain accountability and alignment with current risks, as mandated by Implementing Regulation (EU) 2024/2690 Annex 1.1.2.
Criterion and evidence
Per Implementing Regulation (EU) 2024/2690 Annex 1.1.2, management bodies shall review/update documented cybersecurity roles/responsibilities after significant incidents or operational changes. Valid evidence includes dated review records with rationale showing timing and adjustment rationale (e.g., management board minutes). Absence of evidence despite incidents constitutes non-compliance.
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Roles, Responsibilities, Authorities, and Security Policy. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What qualifies as a significant incident or operational change?
Events materially affecting cybersecurity risk posture or operational continuity as defined in Implementing Regulation (EU) 2024/2690 Annex 1.1.2, requiring documented review evidence. ENISA guidance provides role-mapping context but does not define this regulatory trigger.
How are missing evidence cases assessed?
Pending submission of review records; absence of documented review despite identified incidents/changes constitutes non-compliance per fixture-D1-2 evidence pattern.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures (Version 1.0)