[non-validated] Management-Approved Roles Documentation (NIS2 Art.21)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have documented roles and responsibilities for cybersecurity functions been formally approved by management bodies as required under Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g)?
Explanation
[non-validated] Have cybersecurity roles and responsibilities been formally documented and approved by management bodies according to Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g)? This assesses whether accountability frameworks exist for security functions within the evidence period.
Criterion and evidence
Verification requires management-approved documentation showing defined cybersecurity roles/responsibilities per Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g), covering evidence period operations. Valid alternatives: None (mandatory requirement). Missing evidence: Pending submission (not automatically failed).
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Roles, Responsibilities, Authorities, and Security Policy. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What constitutes sufficient evidence for verification?
Management-approved policy document dated within evidence period explicitly defining cybersecurity roles/responsibilities as required by Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g). Board minutes without formal documentation are insufficient (D-source-1 p2).
How are missing/contradictory records handled?
Pending submission when evidence is unavailable (no automatic negative outcome). Conflicting documents require current approved version verification per ENISA guidance (D-source-1 p3 annual review requirement). No alternatives satisfy this mandatory criterion.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures (Version 1.0)