-
Notifications
You must be signed in to change notification settings - Fork 293
/
Copy pathannex-implementing-regulation-of-nis2-on-t-m.yaml
8227 lines (8227 loc) · 432 KB
/
annex-implementing-regulation-of-nis2-on-t-m.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:annex-technical-and-methodological-requirements-nis2
locale: en
ref_id: 'Annex-to-the-Implementing-Regulation-of-NIS2-on-Technical-and-methodological-requirements '
name: NIS2 technical and methodological requirements 2024/2690
description: ANNEX to the Commission Implementing Regulation laying down rules for
the application of Directive (EU) 2022/2555 as regards technical and methodological
requirements of cybersecurity risk-management measures and further specification
of the cases in which an incident is considered to be significant with regard to
DNS service providers, TLD name registries, cloud computing service providers, data
centre service providers, content delivery network providers, managed service providers,
managed security service providers, providers of online market places, of online
search engines and of social networking services platforms, and trust service providers
copyright: EUROPEAN COMMISSION
version: 4
publication_date: 2024-10-26
provider: EUROPEAN COMMISSION
packager: intuitem
translations:
es:
name: "NIS2: Requisitos t\xE9cnicos y metodol\xF3gicos - ANEXO REGLAMENTO DE EJECUCI\xD3\
N (UE) 2024/2690"
description: "ANEXO del Reglamento de Ejecuci\xF3n de la Comisi\xF3n por el que\
\ se establecen -seg\xFAn el art\xEDculo 2- las disposiciones de aplicaci\xF3\
n de la Directiva (UE) 2022/2555 en lo que respecta a los requisitos t\xE9cnicos\
\ y metodol\xF3gicos de las medidas para la gesti\xF3n de riesgos de ciberseguridad.\
\ Link: https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=OJ:L_202402690"
copyright: COMISION EUROPEA
cs:
name: "NIS2: technick\xE9 a metodick\xE9 po\u017Eadavky 2024/2690"
description: "Prov\xE1d\u011Bc\xED na\u0159\xEDzen\xED 2024/2690 kter\xFDm se\
\ stanov\xED pravidla pro uplat\u0148ov\xE1n\xED sm\u011Brnice (EU) 2022/2555,\
\ pokud jde o technick\xE9 a metodick\xE9 po\u017Eadavky na opat\u0159en\xED\
\ k \u0159\xEDzen\xED kybernetick\xFDch bezpe\u010Dnostn\xEDch rizik a bli\u017E\
\u0161\xED up\u0159esn\u011Bn\xED p\u0159\xEDpad\u016F, v nich\u017E se incident\
\ pova\u017Euje za v\xFDznamn\xFD, pokud jde o provozovatele DNS, registry dom\xE9\
n nejvy\u0161\u0161\xED \xFArovn\u011B, poskytovatele slu\u017Eeb cloud computingu,\
\ poskytovatele slu\u017Eeb datov\xFDch center, poskytovatele s\xEDt\xED pro\
\ doru\u010Dov\xE1n\xED obsahu, poskytovatele \u0159\xEDzen\xFDch slu\u017E\
eb, poskytovatele \u0159\xEDzen\xFDch bezpe\u010Dnostn\xEDch slu\u017Eeb, poskytovatele\
\ on-line tr\u017Ei\u0161\u0165, internetov\xFDch vyhled\xE1va\u010D\u016F a\
\ slu\u017Eeb platforem soci\xE1ln\xEDch s\xEDt\xED a poskytovatele slu\u017E\
eb vytv\xE1\u0159ej\xEDc\xEDch d\u016Fv\u011Bru. https://eur-lex.europa.eu/legal-content/CS/TXT/HTML/?uri=OJ:L_202402690"
copyright: "EVROPSK\xC1 KOMISE"
objects:
framework:
urn: urn:intuitem:risk:framework:annex-technical-and-methodological-requirements-nis2
ref_id: 'Annex-to-the-Implementing-Regulation-of-NIS2-on-Technical-and-methodological-requirements '
name: NIS2 technical and methodological requirements 2024/2690
description: ANNEX to the Commission Implementing Regulation laying down rules
for the application of Directive (EU) 2022/2555 as regards technical and methodological
requirements of cybersecurity risk-management measures and further specification
of the cases in which an incident is considered to be significant with regard
to DNS service providers, TLD name registries, cloud computing service providers,
data centre service providers, content delivery network providers, managed service
providers, managed security service providers, providers of online market places,
of online search engines and of social networking services platforms, and trust
service providers
translations:
es:
name: "NIS2: Requisitos t\xE9cnicos y metodol\xF3gicos - ANEXO REGLAMENTO\
\ DE EJECUCI\xD3N (UE) 2024/2690"
description: "ANEXO del Reglamento de Ejecuci\xF3n de la Comisi\xF3n por el\
\ que se establecen -seg\xFAn el art\xEDculo 2- las disposiciones de aplicaci\xF3\
n de la Directiva (UE) 2022/2555 en lo que respecta a los requisitos t\xE9\
cnicos y metodol\xF3gicos de las medidas para la gesti\xF3n de riesgos de\
\ ciberseguridad. Link: https://eur-lex.europa.eu/legal-content/ES/TXT/HTML/?uri=OJ:L_202402690"
cs:
name: "NIS2: technick\xE9 a metodick\xE9 po\u017Eadavky 2024/2690"
description: "Prov\xE1d\u011Bc\xED na\u0159\xEDzen\xED 2024/2690 kter\xFD\
m se stanov\xED pravidla pro uplat\u0148ov\xE1n\xED sm\u011Brnice (EU) 2022/2555,\
\ pokud jde o technick\xE9 a metodick\xE9 po\u017Eadavky na opat\u0159en\xED\
\ k \u0159\xEDzen\xED kybernetick\xFDch bezpe\u010Dnostn\xEDch rizik a bli\u017E\
\u0161\xED up\u0159esn\u011Bn\xED p\u0159\xEDpad\u016F, v nich\u017E se\
\ incident pova\u017Euje za v\xFDznamn\xFD, pokud jde o provozovatele DNS,\
\ registry dom\xE9n nejvy\u0161\u0161\xED \xFArovn\u011B, poskytovatele\
\ slu\u017Eeb cloud computingu, poskytovatele slu\u017Eeb datov\xFDch center,\
\ poskytovatele s\xEDt\xED pro doru\u010Dov\xE1n\xED obsahu, poskytovatele\
\ \u0159\xEDzen\xFDch slu\u017Eeb, poskytovatele \u0159\xEDzen\xFDch bezpe\u010D\
nostn\xEDch slu\u017Eeb, poskytovatele on-line tr\u017Ei\u0161\u0165, internetov\xFD\
ch vyhled\xE1va\u010D\u016F a slu\u017Eeb platforem soci\xE1ln\xEDch s\xED\
t\xED a poskytovatele slu\u017Eeb vytv\xE1\u0159ej\xEDc\xEDch d\u016Fv\u011B\
ru. https://eur-lex.europa.eu/legal-content/CS/TXT/HTML/?uri=OJ:L_202402690"
requirement_nodes:
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1
assessable: false
depth: 1
ref_id: '1'
name: POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2),
POINT (A) OF DIRECTIVE (EU) 2022/2555)
translations:
es:
name: "POL\xCDTICA SOBRE LA SEGURIDAD DE LOS SISTEMAS DE REDES Y DE INFORMACI\xD3\
N [Art\xEDculo 21, Apartado 2, Letra A), de la directiva (UE) 2022/2555]"
description: null
cs:
name: " Politika bezpe\u010Dnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9\
m\u016F (\u010Dl. 21 odst. 2 p\xEDsm. a) sm\u011Brnice (EU) 2022/2555)"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1
ref_id: '1.1'
name: Policy on the security of network and information systems
translations:
es:
name: "Pol\xEDtica sobre la seguridad de las redes y sistemas de informaci\xF3\
n"
description: null
cs:
name: "Politika bezpe\u010Dnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9\
m\u016F"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1
ref_id: 1.1.1
description: 'For the purpose of Article 21(2), point (a) of Directive (EU)
2022/2555, the policy on the security of network and information systems shall:'
translations:
es:
name: null
description: "A efectos del art\xEDculo 21, apartado 2, letra a), de la\
\ Directiva (UE) 2022/2555, la pol\xEDtica de seguridad de los sistemas\
\ de redes y de informaci\xF3n:"
cs:
name: null
description: "\tPro \xFA\u010Dely \u010Dl. 21 odst. 2 p\xEDsm. a) sm\u011B\
rnice (EU) 2022/2555 politika bezpe\u010Dnosti s\xEDt\xED a informa\u010D\
n\xEDch syst\xE9m\u016F:"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.a
description: "set out the relevant entities\u2019 approach to managing the security\
\ of their network and information systems;"
translations:
es:
name: null
description: "determinar\xE1 el enfoque de las entidades pertinentes para\
\ gestionar la seguridad de sus sistemas de redes y de informaci\xF3n;"
cs:
name: null
description: "stanov\xED p\u0159\xEDstup p\u0159\xEDslu\u0161n\xFDch subjekt\u016F\
\ k \u0159\xEDzen\xED bezpe\u010Dnosti jejich s\xEDt\xED a informa\u010D\
n\xEDch syst\xE9m\u016F;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.b
description: "be appropriate to and complementary with the relevant entities\u2019\
\ business strategy and objectives;"
translations:
es:
name: null
description: "se adecuar\xE1 a la estrategia y los objetivos operativos\
\ de las entidades pertinentes y los completar\xE1;"
cs:
name: null
description: "odpov\xEDd\xE1 obchodn\xED strategii a c\xEDl\u016Fm p\u0159\
\xEDslu\u0161n\xFDch subjekt\u016F a dopl\u0148uje je;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.c
description: set out network and information security objectives;
translations:
es:
name: null
description: "establecer\xE1 los objetivos de seguridad de las redes y de\
\ la informaci\xF3n;"
cs:
name: null
description: "stanov\xED c\xEDle bezpe\u010Dnosti s\xEDt\xED a informac\xED\
;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.d
description: include a commitment to continual improvement of the security of
network and information systems;
translations:
es:
name: null
description: "se comprometer\xE1 a mejorar constantemente la seguridad de\
\ los sistemas de redes y de informaci\xF3n;"
cs:
name: null
description: "obsahuje z\xE1vazek k neust\xE1l\xE9mu zlep\u0161ov\xE1n\xED\
\ bezpe\u010Dnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.e
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.e
description: include a commitment to provide the appropriate resources needed
for its implementation, including the necessary staff, financial resources,
processes, tools and technologies;
translations:
es:
name: null
description: "se comprometer\xE1 a facilitar los recursos oportunos para\
\ su aplicaci\xF3n, incluidos el personal, los recursos financieros, los\
\ procedimientos, las herramientas y las tecnolog\xEDas que se necesiten;"
cs:
name: null
description: "obsahuje z\xE1vazek poskytnout odpov\xEDdaj\xEDc\xED zdroje\
\ pot\u0159ebn\xE9 pro jej\xED proveden\xED, v\u010Detn\u011B pot\u0159\
ebn\xFDch zam\u011Bstnanc\u016F, finan\u010Dn\xEDch zdroj\u016F, postup\u016F\
, n\xE1stroj\u016F a technologi\xED;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.f
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.f
description: be communicated to and acknowledged by relevant employees and relevant
interested external parties;
translations:
es:
name: null
description: "ser\xE1 comunicada a los empleados y partes externas que proceda,\
\ que deber\xE1n aprobarla;"
cs:
name: null
description: "je sd\u011Blena p\u0159\xEDslu\u0161n\xFDm zam\u011Bstnanc\u016F\
m a dot\u010Den\xFDm z\xFA\u010Dastn\u011Bn\xFDm extern\xEDm stran\xE1\
m a je jimi uzn\xE1na;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.g
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.g
description: lay down roles and responsibilities pursuant to point 1.2.;
translations:
es:
name: null
description: "presentar\xE1 los roles y responsabilidades con arreglo al\
\ punto 1.2;"
cs:
name: null
description: "stanov\xED role a odpov\u011Bdnosti podle bodu 1.2.;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.h
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.h
description: list the documentation to be kept and the duration of retention
of the documentation;
translations:
es:
name: null
description: "detallar\xE1 la documentaci\xF3n que debe conservarse y la\
\ duraci\xF3n del per\xEDodo de conservaci\xF3n;"
cs:
name: null
description: "uv\xE1d\xED seznam dokumentace, kter\xE1 m\xE1 b\xFDt uchov\xE1\
v\xE1na, a dobu jej\xEDho uchov\xE1v\xE1n\xED;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.i
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.i
description: list the topic-specific policies;
translations:
es:
name: null
description: "enumerar\xE1 las pol\xEDticas espec\xEDficas;"
cs:
name: null
description: "uv\xE1d\xED seznam politik specifick\xFDch pro toto t\xE9\
ma;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.j
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.j
description: "lay down indicators and measures to monitor its implementation\
\ and the current status of relevant entities\u2019 maturity level of network\
\ and information security;"
translations:
es:
name: null
description: "fijar\xE1 indicadores y medidas para supervisar su aplicaci\xF3\
n y el estado actual del nivel de madurez de la seguridad de las redes\
\ y de la informaci\xF3n de las entidades pertinentes;"
cs:
name: null
description: "stanov\xED ukazatele a opat\u0159en\xED ke sledov\xE1n\xED\
\ jej\xEDho prov\xE1d\u011Bn\xED a aktu\xE1ln\xEDho stavu \xFArovn\u011B\
\ vysp\u011Blosti bezpe\u010Dnosti s\xEDt\xED a informac\xED p\u0159\xED\
slu\u0161n\xFDch subjekt\u016F;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1.k
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.1
ref_id: 1.1.1.k
description: "indicate the date of the formal approval by the management bodies\
\ of the relevant entities (the \u2018management bodies\u2019)."
translations:
es:
name: null
description: "indicar\xE1 la fecha de la aprobaci\xF3n formal por parte\
\ de los \xF3rganos de direcci\xF3n de las entidades pertinentes [en adelante,\
\ \xAB\xF3rgano(s) de direcci\xF3n\xBB]."
cs:
name: null
description: "uv\xE1d\xED datum form\xE1ln\xEDho schv\xE1len\xED \u0159\xED\
d\xEDc\xEDmi org\xE1ny p\u0159\xEDslu\u0161n\xFDch subjekt\u016F (d\xE1\
le jen \u201E\u0159\xEDd\xEDc\xED org\xE1ny\u201C)."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.1
ref_id: 1.1.2
description: The network and information system security policy shall be reviewed
and, where appropriate, updated by management bodies at least annually and
when significant incidents or significant changes to operations or risks occur.
The result of the reviews shall be documented.
translations:
es:
name: null
description: "El \xF3rgano de direcci\xF3n revisar\xE1 y, cuando proceda,\
\ actualizar\xE1 la pol\xEDtica de seguridad de los sistemas de redes\
\ y de informaci\xF3n al menos una vez al a\xF1o, as\xED como cuando se\
\ produzcan incidentes significativos o cambios significativos en las\
\ operaciones o los riesgos. Los resultados de las revisiones quedar\xE1\
n documentados."
cs:
name: null
description: "Bezpe\u010Dnostn\xED politiku v oblasti s\xEDt\xED a informa\u010D\
n\xEDch syst\xE9m\u016F \u0159\xEDd\xEDc\xED org\xE1ny p\u0159ezkoum\xE1\
vaj\xED a v p\u0159\xEDpad\u011B pot\u0159eby aktualizuj\xED nejm\xE9\
n\u011B ka\u017Ed\xFD rok a v\u017Edy v p\u0159\xEDpad\u011B v\xFDskytu\
\ v\xFDznamn\xFDch incident\u016F nebo v\xFDznamn\xFDch zm\u011Bn operac\xED\
\ \u010Di rizik. V\xFDsledky p\u0159ezkum\u016F se zdokumentuj\xED."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1
ref_id: '1.2'
name: Roles, responsibilities and authorities
translations:
es:
name: Roles, responsabilidades y autoridades
description: null
cs:
name: "\xDAkoly, odpov\u011Bdnosti a pravomoci"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.1
description: "As part of their policy on the security of network and information\
\ systems referred to in point 1.1., the relevant entities shall lay down\
\ responsibilities and authorities for network and information system security\
\ and assign them to roles, allocate them according to the relevant entities\u2019\
\ needs, and communicate them to the management bodies."
translations:
es:
name: null
description: "Como parte de la pol\xEDtica de seguridad de los sistemas\
\ de redes y de informaci\xF3n a que hace referencia el punto 1.1, las\
\ entidades pertinentes determinar\xE1n las responsabilidades y autoridades\
\ en materia de seguridad de los sistemas de redes y de informaci\xF3\
n y las asignar\xE1n a distintos roles, las repartir\xE1n en funci\xF3\
n de las necesidades de la entidad y se las comunicar\xE1n a los \xF3\
rganos de direcci\xF3n."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty v r\xE1mci sv\xE9 politiky\
\ bezpe\u010Dnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F uveden\xE9\
\ v bod\u011B 1.1 stanov\xED odpov\u011Bdnosti a pravomoci v oblasti bezpe\u010D\
nosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F, p\u0159id\u011B\
l\xED je k \xFAkol\u016Fm, rozd\u011Bl\xED je podle pot\u0159eb p\u0159\
\xEDslu\u0161n\xFDch subjekt\u016F a sd\u011Bl\xED je \u0159\xEDd\xED\
c\xEDm org\xE1n\u016Fm."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.2
description: The relevant entities shall require all personnel and third parties
to apply network and information system security in accordance with the established
network and information security policy, topic-specific policies and procedures
of the relevant entities.
translations:
es:
name: null
description: "Las entidades pertinentes exigir\xE1n a todo el personal y\
\ a terceros que apliquen la seguridad de los sistemas de redes y de informaci\xF3\
n de conformidad con la pol\xEDtica de seguridad de las redes y la informaci\xF3\
n y las pol\xEDticas espec\xEDficas existentes, as\xED como con los procedimientos\
\ de las entidades pertinentes."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty vy\u017Eaduj\xED, aby v\u0161\
ichni zam\u011Bstnanci a t\u0159et\xED strany uplat\u0148ovali bezpe\u010D\
nost s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F v souladu se zavedenou\
\ politikou bezpe\u010Dnosti s\xEDt\xED a informac\xED, tematicky zam\u011B\
\u0159en\xFDmi politikami a postupy p\u0159\xEDslu\u0161n\xFDch subjekt\u016F\
."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.3
description: At least one person shall report directly to the management bodies
on matters of network and information system security.
translations:
es:
name: null
description: "Al menos una persona informar\xE1 directamente a los \xF3\
rganos de direcci\xF3n sobre cuestiones de seguridad de los sistemas de\
\ redes y de informaci\xF3n."
cs:
name: null
description: "\u0158\xEDd\xEDc\xEDm org\xE1n\u016Fm je v ot\xE1zk\xE1ch\
\ bezpe\u010Dnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F p\u0159\
\xEDmo pod\u0159\xEDzena alespo\u0148 jedna osoba."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.4
description: Depending on the size of the relevant entities, network and information
system security shall be covered by dedicated roles or duties carried out
in addition to existing roles.
translations:
es:
name: null
description: "En funci\xF3n del tama\xF1o de las entidades pertinentes,\
\ la seguridad de las redes y los sistemas de informaci\xF3n corresponder\xE1\
\ a roles o funciones espec\xEDficos que se desempe\xF1ar\xE1n adem\xE1\
s de los roles existentes."
cs:
name: null
description: "V z\xE1vislosti na velikosti p\u0159\xEDslu\u0161n\xFDch subjekt\u016F\
\ spad\xE1 bezpe\u010Dnost s\xEDt\xED a informa\u010Dn\xEDch syst\xE9\
m\u016F pod specializovan\xE9 \xFAkoly nebo povinnosti, kter\xE9 jsou\
\ vykon\xE1v\xE1ny nad r\xE1mec st\xE1vaj\xEDc\xEDch \xFAkol\u016F."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.5
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.5
description: Conflicting duties and conflicting areas of responsibility shall
be segregated, where applicable.
translations:
es:
name: null
description: "Aquellos cargos o \xE1reas de responsabilidad que entren en\
\ conflicto se separar\xE1n, cuando proceda."
cs:
name: null
description: "Koliduj\xEDc\xED povinnosti a protich\u016Fdn\xE9 oblasti\
\ odpov\u011Bdnosti budou v p\u0159\xEDslu\u0161n\xFDch p\u0159\xEDpadech\
\ odd\u011Bleny."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2.6
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:1.2
ref_id: 1.2.6
description: Roles, responsibilities and authorities shall be reviewed and,
where appropriate, updated by management bodies at planned intervals and when
significant incidents or significant changes to operations or risks occur.
translations:
es:
name: null
description: "Los \xF3rganos de direcci\xF3n revisar\xE1n y, cuando proceda,\
\ actualizar\xE1n los roles, responsabilidades y autoridades a intervalos\
\ planificados, as\xED como cuando se produzcan incidentes significativos\
\ o cambios significativos en las operaciones o los riesgos."
cs:
name: null
description: "\u0158\xEDd\xEDc\xED org\xE1ny \xFAkoly, odpov\u011Bdnosti\
\ a pravomoci p\u0159ezkoum\xE1vaj\xED a v p\u0159\xEDpad\u011B pot\u0159\
eby aktualizuj\xED v pl\xE1novan\xFDch intervalech a p\u0159i v\xFDskytu\
\ v\xFDznamn\xFDch incident\u016F nebo v\xFDznamn\xFDch zm\u011Bn operac\xED\
\ \u010Di rizik."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2
assessable: false
depth: 1
ref_id: '2'
name: RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)
translations:
es:
name: "POL\xCDTICA DE GESTI\xD3N DE RIESGOS [Art\xEDculo 21, Apartado 2,\
\ Letra A), de la directiva (UE) 2022/2555]"
description: null
cs:
name: "Politika \u0159\xEDzen\xED rizik (\u010Dl. 21 odst. 2 bod a) sm\u011B\
rnice (EU) 2022/2555)"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2
ref_id: '2.1'
name: Risk management framework
translations:
es:
name: "Marco de la gesti\xF3n de riesgos"
description: null
cs:
name: "R\xE1mec pro \u0159\xEDzen\xED rizik"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1
ref_id: 2.1.1
description: For the purpose of Article 21(2), point (a) of Directive (EU) 2022/2555,
the relevant entities shall establish and maintain an appropriate risk management
framework to identify and address the risks posed to the security of network
and information systems. The relevant entities shall perform and document
risk assessments and, based on the results, establish, implement and monitor
a risk treatment plan. Risk assessment results and residual risks shall be
accepted by management bodies or, where applicable, by persons who are accountable
and have the authority to manage risks, provided that the relevant entities
ensure adequate reporting to the management bodies.
translations:
es:
name: null
description: "A efectos del art\xEDculo 21, apartado 2, letra a), de la\
\ Directiva (UE) 2022/2555, las entidades pertinentes establecer\xE1n\
\ y mantendr\xE1n un marco de la gesti\xF3n de riesgos adecuado para detectar\
\ y abordar los riesgos que se planteen para la seguridad de los sistemas\
\ de redes y de informaci\xF3n. Las entidades pertinentes realizar\xE1\
n evaluaciones de riesgos cuyos resultados documentar\xE1n y, a partir\
\ de estos \xFAltimos, establecer\xE1n un plan de tratamiento de riesgos,\
\ que aplicar\xE1n y supervisar\xE1n. Siempre que las entidades pertinentes\
\ garanticen una informaci\xF3n adecuada a los \xF3rganos de direcci\xF3\
n, estos \xFAltimos o, cuando proceda, las personas que sean responsables\
\ y tengan autoridad para gestionar los riesgos, aprobar\xE1n los resultados\
\ de la evaluaci\xF3n de riesgos y los riesgos residuales."
cs:
name: null
description: "\tPro \xFA\u010Dely \u010Dl. 21 odst. 2 p\xEDsm. a) sm\u011B\
rnice (EU) 2022/2555 p\u0159\xEDslu\u0161n\xE9 subjekty z\u0159\xEDd\xED\
\ a spravuj\xED vhodn\xFD r\xE1mec \u0159\xEDzen\xED rizik, aby identifikovaly\
\ a \u0159e\u0161ily rizika pro bezpe\u010Dnost s\xEDt\xED a informa\u010D\
n\xEDch syst\xE9m\u016F. P\u0159\xEDslu\u0161n\xE9 subjekty provedou a\
\ zdokumentuj\xED posouzen\xED rizik a na z\xE1klad\u011B v\xFDsledk\u016F\
\ vypracuj\xED, zavedou a sleduj\xED pl\xE1n o\u0161et\u0159en\xED rizik.\
\ V\xFDsledky posouzen\xED rizik a zbytkov\xE1 rizika p\u0159ij\xEDmaj\xED\
\ \u0159\xEDd\xEDc\xED org\xE1ny nebo v p\u0159\xEDslu\u0161n\xFDch p\u0159\
\xEDpadech osoby, kter\xE9 jsou odpov\u011Bdn\xE9 a maj\xED pravomoc \u0159\
\xEDdit rizika, za p\u0159edpokladu, \u017Ee p\u0159\xEDslu\u0161n\xE9\
\ subjekty zajist\xED odpov\xEDdaj\xEDc\xED pod\xE1v\xE1n\xED zpr\xE1\
v \u0159\xEDd\xEDc\xEDm org\xE1n\u016Fm."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1
ref_id: 2.1.2
description: "For the purpose of point 2.1.1., the relevant entities shall establish\
\ procedures for identification, analysis, assessment and treatment of risks\
\ (\u2018cybersecurity risk management process\u2019). The cybersecurity risk\
\ management process shall be an integral part of the relevant entities\u2019\
\ overall risk management process, where applicable. As part of the cybersecurity\
\ risk management process, the relevant entities shall:"
translations:
es:
name: null
description: "A los efectos del punto 2.1.1, las entidades pertinentes establecer\xE1\
n procedimientos para detectar, analizar, evaluar y tratar los riesgos\
\ (\xABproceso de gesti\xF3n de riesgos de ciberseguridad\xBB). El proceso\
\ de gesti\xF3n de riesgos de ciberseguridad formar\xE1 parte del proceso\
\ de gesti\xF3n de riesgos general de la entidad pertinente, seg\xFAn\
\ proceda. Como parte del proceso de gesti\xF3n de riesgos de ciberseguridad,\
\ las entidades pertinentes:"
cs:
name: null
description: "Pro \xFA\u010Dely bodu 2.1.1 p\u0159\xEDslu\u0161n\xE9 subjekty\
\ stanov\xED postupy pro identifikaci, anal\xFDzu, posouzen\xED a o\u0161\
et\u0159en\xED rizik (d\xE1le jen \u201Eproces \u0159\xEDzen\xED rizik\
\ v oblasti kybernetick\xE9 bezpe\u010Dnosti\u201C). Proces \u0159\xED\
zen\xED rizik v oblasti kybernetick\xE9 bezpe\u010Dnosti mus\xED b\xFD\
t v p\u0159\xEDslu\u0161n\xFDch p\u0159\xEDpadech ned\xEDlnou sou\u010D\
\xE1st\xED celkov\xE9ho procesu \u0159\xEDzen\xED rizik p\u0159\xEDslu\u0161\
n\xFDch subjekt\u016F. V r\xE1mci procesu \u0159\xEDzen\xED rizik v oblasti\
\ kybernetick\xE9 bezpe\u010Dnosti p\u0159\xEDslu\u0161n\xE9 subjekty:"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.a
description: follow a risk management methodology;
translations:
es:
name: null
description: "seguir\xE1n una metodolog\xEDa de gesti\xF3n de riesgos;"
cs:
name: null
description: "dodr\u017Euj\xED metodiku \u0159\xEDzen\xED rizik;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.b
description: establish the risk tolerance level in accordance with the risk
appetite of the relevant entities;
translations:
es:
name: null
description: "establecer\xE1n un nivel de tolerancia al riesgo conforme\
\ con la propensi\xF3n al riesgo de la entidad;"
cs:
name: null
description: "stanov\xED \xFArove\u0148 tolerance rizika v souladu s ochotou\
\ p\u0159\xEDslu\u0161n\xFDch subjekt\u016F riskovat;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.c
description: establish and maintain relevant risk criteria;
translations:
es:
name: null
description: "establecer\xE1n y mantendr\xE1n criterios de riesgo pertinentes;"
cs:
name: null
description: "stanov\xED a spravuj\xED p\u0159\xEDslu\u0161n\xE1 krit\xE9\
ria rizik;"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.d
description: in line with an all-hazards approach, identify and document the
risks posed to the security of network and information systems, in particular
in relation to third parties and risks that could lead to disruptions in the
availability, integrity, authenticity and confidentiality of the network and
information systems, including the identification of single point of failures;
translations:
es:
name: null
description: "de conformidad con un enfoque que abarque todos los riesgos,\
\ determinar\xE1n y registrar\xE1n todos los riesgos existentes para la\
\ seguridad de los sistemas de redes y de informaci\xF3n, en especial\
\ con relaci\xF3n a terceros o a aquellos riesgos que puedan generar alteraciones\
\ en la disponibilidad, integridad, autenticidad y confidencialidad de\
\ los sistemas de redes y de informaci\xF3n, incluida la detecci\xF3n\
\ de puntos \xFAnicos de fallo;"
cs:
name: null
description: "v souladu s p\u0159\xEDstupem zohled\u0148uj\xEDc\xEDm v\u0161\
echny druhy rizik identifikuj\xED a dokumentuj\xED rizika pro bezpe\u010D\
nost s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F, zejm\xE9na ve\
\ vztahu ke t\u0159et\xEDm stran\xE1m, a rizika, kter\xE1 by mohla v\xE9\
st k naru\u0161en\xED dostupnosti, integrity, autenticity a d\u016Fv\u011B\
rnosti s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F, v\u010Detn\u011B\
\ identifikace kritick\xE9ho m\xEDsta (tzv. single point of failures);"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.e
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.e
description: analyse the risks posed to the security of network and information
systems, including threat, likelihood, impact, and risk level, taking into
account cyber threat intelligence and vulnerabilities;
translations:
es:
name: null
description: "analizar\xE1n los riesgos que se planteen para la seguridad\
\ de los sistemas de redes y de informaci\xF3n, especialmente la amenaza,\
\ la probabilidad, el impacto y el nivel de riesgo, teniendo en cuenta\
\ la inteligencia sobre ciberamenazas y las vulnerabilidades;"
cs:
name: null
description: "analyzuj\xED rizika pro bezpe\u010Dnost s\xEDt\xED a informa\u010D\
n\xEDch syst\xE9m\u016F, v\u010Detn\u011B hrozby, pravd\u011Bpodobnosti,\
\ dopadu a \xFArovn\u011B rizika, s p\u0159ihl\xE9dnut\xEDm k informac\xED\
m o kybernetick\xFDch hrozb\xE1ch a zranitelnostech;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.f
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.f
description: evaluate the identified risks based on the risk criteria;
translations:
es:
name: null
description: "evaluar\xE1n los riesgos detectados a partir de los criterios\
\ de riesgo;"
cs:
name: null
description: "vyhodnot\xED identifikovan\xE1 rizika na z\xE1klad\u011B krit\xE9\
ri\xED rizik;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2;g
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2;g
description: identify and prioritise appropriate risk treatment options and
measures;
translations:
es:
name: null
description: "determinar\xE1n y priorizar\xE1n las opciones y medidas adecuadas\
\ de tratamiento de riesgos;"
cs:
name: null
description: "identifikuj\xED vhodn\xE9 mo\u017Enosti a opat\u0159en\xED\
\ k o\u0161et\u0159en\xED rizik a stanov\xED po\u0159ad\xED jejich d\u016F\
le\u017Eitosti;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.h
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.h
description: continuously monitor the implementation of the risk treatment measures;
translations:
es:
name: null
description: "supervisar\xE1n constantemente la aplicaci\xF3n de las medidas\
\ de tratamiento de riesgos;"
cs:
name: null
description: "pr\u016Fb\u011B\u017En\u011B sleduj\xED prov\xE1d\u011Bn\xED\
\ opat\u0159en\xED k o\u0161et\u0159en\xED rizik;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.i
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.i
description: identify who is responsible for implementing the risk treatment
measures and when they should be implemented;
translations:
es:
name: null
description: "determinar\xE1n qui\xE9n es responsable de la aplicaci\xF3\
n de las medidas de tratamiento de riesgos y cu\xE1ndo deben aplicarse\
\ estas;"
cs:
name: null
description: "ur\u010D\xED, kdo je odpov\u011Bdn\xFD za prov\xE1d\u011B\
n\xED opat\u0159en\xED k o\u0161et\u0159en\xED rizik a kdy by tato opat\u0159\
en\xED m\u011Bla b\xFDt provedena;\n"
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2.j
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.2
ref_id: 2.1.2.j
description: document the chosen risk treatment measures in a risk treatment
plan and the reasons justifying the acceptance of residual risks in a comprehensible
manner.
translations:
es:
name: null
description: "informar\xE1n de manera comprensible de las medidas de tratamiento\
\ de riesgos elegidas en un plan de tratamiento de riesgos y de las razones\
\ que justifiquen la aceptaci\xF3n de los riesgos residuales."
cs:
name: null
description: "komplexn\u011B zdokumentuj\xED zvolen\xE1 opat\u0159en\xED\
\ k o\u0161et\u0159en\xED rizik v pl\xE1nu o\u0161et\u0159en\xED rizik\
\ a d\u016Fvody, kter\xE9 vedly k akceptaci zbytkov\xFDch rizik."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1
ref_id: 2.1.3
description: When identifying and prioritising appropriate risk treatment options
and measures, the relevant entities shall take into account the risk assessment
results, the results of the procedure to assess the effectiveness of cybersecurity
risk-management measures, the cost of implementation in relation to the expected
benefit, the asset classification referred to in point 12.1., and the business
impact analysis referred to in point 4.1.3.
translations:
es:
name: null
description: "Cuando detecten y prioricen las opciones y medidas adecuadas\
\ para el tratamiento de los riesgos, las entidades pertinentes tendr\xE1\
n en cuenta los resultados de la evaluaci\xF3n de riesgos, los resultados\
\ del procedimiento para evaluar la eficacia de las medidas para la gesti\xF3\
n de riesgos de ciberseguridad, el coste de su aplicaci\xF3n en relaci\xF3\
n con los beneficios previstos, la clasificaci\xF3n de activos contemplada\
\ en el punto 12.1 y el an\xE1lisis de impacto operativo a que se refiere\
\ el punto 4.1.3."
cs:
name: null
description: "P\u0159i identifikov\xE1n\xED vhodn\xFDch mo\u017Enost\xED\
\ a opat\u0159en\xED k o\u0161et\u0159en\xED rizik a stanoven\xED po\u0159\
ad\xED jejich d\u016Fle\u017Eitosti p\u0159\xEDslu\u0161n\xE9 subjekty\
\ zohledn\xED v\xFDsledky posouzen\xED rizik, v\xFDsledky postupu pro\
\ zhodnocen\xED \xFA\u010Dinnosti opat\u0159en\xED k \u0159\xEDzen\xED\
\ kybernetick\xFDch bezpe\u010Dnostn\xEDch rizik, n\xE1klady na proveden\xED\
\ ve vztahu k o\u010Dek\xE1van\xE9mu p\u0159\xEDnosu, klasifikaci aktiv\
\ uvedenou v bod\u011B 12.1 a anal\xFDzu obchodn\xEDho dopadu uvedenou\
\ v bod\u011B 4.1.3."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1.4
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.1
ref_id: 2.1.4
description: The relevant entities shall review and, where appropriate, update
the risk assessment results and the risk treatment plan at planned intervals
and at least annually, and when significant changes to operations or risks
or significant incidents occur.
translations:
es:
name: null
description: "Las entidades pertinentes revisar\xE1n y, cuando proceda,\
\ actualizar\xE1n los resultados de la evaluaci\xF3n de riesgos y el plan\
\ de tratamiento de riesgos a intervalos planificados y como m\xEDnimo\
\ anualmente, as\xED como cuando se produzcan incidentes significativos\
\ o cambios significativos en las operaciones o los riegos."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty v\xFDsledky posouzen\xED\
\ rizik a pl\xE1n o\u0161et\u0159en\xED rizik p\u0159ezkoumaj\xED a v\
\ p\u0159\xEDpad\u011B pot\u0159eby aktualizuj\xED v pl\xE1novan\xFDch\
\ intervalech alespo\u0148 jednou ro\u010Dn\u011B a p\u0159i v\xFDskytu\
\ v\xFDznamn\xFDch incident\u016F nebo v\xFDznamn\xFDch zm\u011Bn operac\xED\
\ \u010Di rizik."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2
ref_id: '2.2'
name: Compliance monitoring
translations:
es:
name: Control del cumplimiento
description: null
cs:
name: "Sledov\xE1n\xED souladu"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2
ref_id: 2.2.1
description: The relevant entities shall regularly review the compliance with
their policies on network and information system security, topic-specific
policies, rules, and standards. The management bodies shall be informed of
the status of network and information security on the basis of the compliance
reviews by means of regular reporting.
translations:
es:
name: null
description: "Las entidades pertinentes revisar\xE1n peri\xF3dicamente el\
\ cumplimiento de sus pol\xEDticas en materia de seguridad de los sistemas\
\ de redes y de informaci\xF3n, pol\xEDticas espec\xEDficas, reglas y\
\ normas. Los \xF3rganos de direcci\xF3n ser\xE1n informados, mediante\
\ informes peri\xF3dicos, del estado de seguridad de las redes y la informaci\xF3\
n a partir de las revisiones del cumplimiento."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty pravideln\u011B p\u0159\
ezkoum\xE1vaj\xED dodr\u017Eov\xE1n\xED sv\xFDch politik bezpe\u010Dnosti\
\ s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F, tematicky zam\u011B\
\u0159en\xFDch politik, pravidel a norem. \u0158\xEDd\xEDc\xED org\xE1\
ny jsou informov\xE1ny o stavu bezpe\u010Dnosti s\xEDt\xED a informac\xED\
\ na z\xE1klad\u011B p\u0159ezkum\u016F dodr\u017Eov\xE1n\xED souladu\
\ prost\u0159ednictv\xEDm pravideln\xFDch zpr\xE1v."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2
ref_id: 2.2.2
description: "The relevant entities shall put in place an effective compliance\
\ reporting system which shall be appropriate to their structures, operating\
\ environments and threat landscapes. The compliance reporting system shall\
\ be capable to provide to the management bodies an informed view of the current\
\ state of the relevant entities\u2019 management of risks."
translations:
es:
name: null
description: "Las entidades pertinentes pondr\xE1n en marcha un sistema\
\ eficaz de notificaci\xF3n del cumplimiento que ser\xE1 adecuado a sus\
\ estructuras, sus entornos operativos y su panorama de amenazas. El sistema\
\ de notificaci\xF3n del cumplimiento podr\xE1 ofrecer a los \xF3rganos\
\ de direcci\xF3n una visi\xF3n informada del estado en que se encuentre\
\ la gesti\xF3n de riesgos de las entidades pertinentes."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty zavedou \xFA\u010Dinn\xFD\
\ syst\xE9m pod\xE1v\xE1n\xED zpr\xE1v o dodr\u017Eov\xE1n\xED souladu,\
\ kter\xFD bude odpov\xEDdat jejich struktu\u0159e, provozn\xEDmu prost\u0159\
ed\xED a prost\u0159ed\xED hrozeb. Syst\xE9m pod\xE1v\xE1n\xED zpr\xE1\
v o dodr\u017Eov\xE1n\xED souladu mus\xED b\xFDt schopen poskytovat \u0159\
\xEDdic\xEDm org\xE1n\u016Fm informovan\xFD p\u0159ehled o aktu\xE1ln\xED\
m stavu \u0159\xEDzen\xED rizik p\u0159\xEDslu\u0161n\xFDmi subjekty."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.2
ref_id: 2.2.3
description: The relevant entities shall perform the compliance monitoring at
planned intervals and when significant incidents or significant changes to
operations or risks occur.
translations:
es:
name: null
description: "Las entidades pertinentes realizar\xE1n el control del cumplimiento\
\ a intervalos planificados, as\xED como cuando se produzcan incidentes\
\ significativos o cambios significativos en las operaciones o los riesgos."
cs:
name: null
description: "\tP\u0159\xEDslu\u0161n\xE9 subjekty prov\xE1d\u011Bj\xED\
\ sledov\xE1n\xED souladu v pl\xE1novan\xFDch intervalech a p\u0159i v\xFD\
skytu v\xFDznamn\xFDch incident\u016F nebo v\xFDznamn\xFDch zm\u011Bn\
\ operac\xED \u010Di rizik."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2
ref_id: '2.3'
name: Independent review of information and network security
translations:
es:
name: "Revisi\xF3n independiente de la seguridad de la informaci\xF3n y\
\ las redes"
description: null
cs:
name: "Nez\xE1visl\xFD p\u0159ezkum bezpe\u010Dnosti informac\xED a s\xED\
t\xED"
description: null
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3.1
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3
ref_id: 2.3.1
description: The relevant entities shall review independently their approach
to managing network and information system security and its implementation
including people, processes and technologies.
translations:
es:
name: null
description: "Las entidades pertinentes revisar\xE1n de forma independiente\
\ su enfoque de gesti\xF3n de la seguridad de los sistemas de redes y\
\ de informaci\xF3n y su aplicaci\xF3n, incluidas las personas, los procesos\
\ y las tecnolog\xEDas."
cs:
name: null
description: "P\u0159\xEDslu\u0161n\xE9 subjekty nez\xE1visle p\u0159ezkoum\xE1\
vaj\xED sv\u016Fj p\u0159\xEDstup k \u0159\xEDzen\xED bezpe\u010Dnosti\
\ s\xEDt\xED a informa\u010Dn\xEDch syst\xE9m\u016F a jeho prov\xE1d\u011B\
n\xED, v\u010Detn\u011B lid\xED, proces\u016F a technologi\xED."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3.2
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3
ref_id: 2.3.2
description: The relevant entities shall develop and maintain processes to conduct
independent reviews which shall be carried out by individuals with appropriate
audit competence. Where the independent review is conducted by staff members
of the relevant entity, the persons conducting the reviews shall not be in
the line of authority of the personnel of the area under review. If the size
of the relevant entities does not allow such separation of line of authority,
the relevant entities shall put in place alternative measures to guarantee
the impartiality of the reviews.
translations:
es:
name: null
description: "Las entidades pertinentes desarrollar\xE1n y mantendr\xE1\
n procedimientos para llevar a cabo revisiones independientes que ser\xE1\
n ejecutados por personas con las debidas competencias en materia de auditor\xED\
a. Cuando miembros del personal de la entidad pertinente realicen una\
\ revisi\xF3n independiente, las personas encargadas de la misma no podr\xE1\
n ejercer poder jer\xE1rquico sobre el personal de la zona objeto de la\
\ revisi\xF3n. Si el tama\xF1o de la entidad pertinente no permite esta\
\ separaci\xF3n del poder jer\xE1rquico, la entidad pondr\xE1 en marcha\
\ medidas alternativas para garantizar la imparcialidad de las revisiones."
cs:
name: null
description: "\tP\u0159\xEDslu\u0161n\xE9 subjekty vypracov\xE1vaj\xED a\
\ spravuj\xED postupy pro prov\xE1d\u011Bn\xED nez\xE1visl\xFDch p\u0159\
ezkum\u016F, kter\xE9 vykon\xE1vaj\xED osoby s pat\u0159i\u010Dnou kvalifikac\xED\
\ pro audit. Pokud nez\xE1visl\xFD p\u0159ezkum vykon\xE1vaj\xED zam\u011B\
stnanci p\u0159\xEDslu\u0161n\xE9ho subjektu, nesm\xED b\xFDt osoby prov\xE1\
d\u011Bj\xEDc\xED p\u0159ezkumy pod\u0159\xEDzeny zam\u011Bstnanc\u016F\
m p\u0159ezkoum\xE1van\xE9 oblasti. V p\u0159\xEDpad\u011B, \u017Ee velikost\
\ p\u0159\xEDslu\u0161n\xFDch subjekt\u016F neumo\u017E\u0148uje takov\xE9\
\ odd\u011Blen\xED pravomoc\xED, zavedou p\u0159\xEDslu\u0161n\xE9 subjekty\
\ alternativn\xED opat\u0159en\xED, kter\xE1 zaru\u010D\xED nestrannost\
\ p\u0159ezkum\u016F."
- urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3.3
assessable: true
depth: 3
parent_urn: urn:intuitem:risk:req_node:annex-technical-and-methodological-requirements-nis2:2.3
ref_id: 2.3.3
description: "The results of the independent reviews, including the results\
\ from the compliance monitoring pursuant to point 2.2. and the monitoring\
\ and measurement pursuant to point 7, shall be reported to the management\
\ bodies. Corrective actions shall be taken or residual risk accepted according\
\ to the relevant entities\u2019 risk acceptance criteria."
translations:
es:
name: null
description: "Los resultados de las revisiones independientes, especialmente\