NIS2 Croatia | Članak 34 | Provedba revizije kibernetičke sigurnosti

Requirement description

(1) Reviziju kibernetičke sigurnosti ključni subjekti dužni su provoditi najmanje jednom u dvije godine.
(2) Reviziju kibernetičke sigurnosti ključni subjekti dužni su provesti i prije isteka roka iz stavka 1. ovoga članka, kada to zatraži nadležno tijelo za provedbu zahtjeva kibernetičke sigurnosti na temelju članka 79. stavka 1. podstavka 7. ili članka 81. stavka 1. podstavka 2. ovoga Zakona.
(3) Revizija kibernetičke sigurnosti iz stavka 1. ovoga članka provodi se kao zaseban postupak ili u okviru revizije poslovanja odnosno druge provjere sukladnosti subjekata koja se provodi na temelju posebnih propisa kojima se uređuje područje pružanja određenih usluga odnosno obavljanja određenih djelatnosti.
(4) Reviziju kibernetičke sigurnosti važni subjekti dužni su provesti kada to zatraži nadležno tijelo za provedbu zahtjeva kibernetičke sigurnosti na temelju članka 79. stavka 1. podstavka 7. ovoga Zakona.
(5) Izvješće iz članka 32. stavka 4. ovoga Zakona ključni i važni subjekti dužni su dostaviti nadležnom tijelu za provedbu zahtjeva kibernetičke sigurnosti bez odgode, a najkasnije u roku od osam dana od dana njegova primitka.
(6) Iznimno od stavka 5. ovoga članka, kada je revizija kibernetičke sigurnosti provedena na zahtjev nadležnog tijela za provedbu zahtjeva kibernetičke sigurnosti na temelju članka 79. stavka 1. podstavka 7. ili članka 81. stavka 1. podstavka 2. ovoga Zakona, subjekt za koji je revizija kibernetičke sigurnosti provedena dužan je izvješće iz članka 32. stavka 4. ovoga Zakona dostaviti nadležnom tijelu za provedbu zahtjeva kibernetičke sigurnosti odmah po njegovu primitku.
(7) Troškove provedbe revizije kibernetičke sigurnosti snose ključni i važni subjekti, ako nije drugačije propisano ovim Zakonom.

How to fill the requirement

Zakon o kibernetičkoj sigurnosti (Croatia)

Članak 34: Provedba revizije kibernetičke sigurnosti

Task name

Priority

Status

Theme

Policy

Other requirements

Conducting an external audit

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Risk management and leadership

Cyber security management

requirements

Examples of other requirements this task affects

Članak 34: Provedba revizije kibernetičke sigurnosti

NIS2 Croatia

See all related requirements and other information from tasks own page.

Go to >

Conducting an external audit

1. Task description

Organizations should conduct an external audit at least once every two years or whenever it's requested by competent authority, as mandated by applicable laws and regulations.

Audits are conducted by cybersecurity auditors, who are responsible for preparing a report on the audit findings. Organizations should note that some laws and regulations may require auditors to hold specific certifications, e.g. national cybersecurity audit security certificate or audit has to be done by specific authority.

Organizations are required to submit the report to the competent authority responsible for implementing cybersecurity requirements immediately upon receipt, if mandated by laws and regulations.

Tasks included in the policy

Task name

Priority

Status

Theme

Policy

Other requirements

No items found.

38: Kiberuzbrukumu attiecināšana

NIS2 Latvia

1.1 (MIL2): Manage IT and OT Asset Inventory

C2M2

1.1 (MIL3): Manage IT and OT Asset Inventory

C2M2

1.1.1: Availability of information security policies

TISAX

1.1.1: Identify the organisation’s strategy and priorities

NSM ICT-SP

1.1.2: Identify the organisation’s structures and processes for security management

NSM ICT-SP

1.1.3: Identify the organisation’s processes for ICT risk management

NSM ICT-SP

1.1.4: Identify the organisation’s tolerances for ICT risk

NSM ICT-SP

1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions

NSM ICT-SP

1.1.6: Identify information processing and data flow

NSM ICT-SP

1.1: Establish and Maintain Detailed Enterprise Asset Inventory

CIS 18

1.2 (MIL2): Manage Information Asset Inventory

C2M2

1.2 (MIL3): Manage Information Asset Inventory

C2M2

1.2.1: Establish a process to identify devices and software in use at the organisation

NSM ICT-SP

1.2.1: Scope of Information Security management

TISAX

1.2.2: Establish organisational guidelines for approved devices and software

NSM ICT-SP

1.2.2: Information Security Responsibilities

TISAX

1.2.3: Identify devices in use at the organisation

NSM ICT-SP

1.2.3: Information Security requirements in projects

TISAX

1.2.4: Definition of responsibilities with service providers

TISAX

1.2.4: Identify the software in use at the organisation

NSM ICT-SP

1.2: Address Unauthorized Assets

CIS 18

1.2: Manage Information Asset Inventory

C2M2

1.3 (MIL2): Manage IT and OT Asset Configuration

C2M2

1.3 (MIL3): Manage IT and OT Asset Configuration

C2M2

1.3.1: Identification of information assets

TISAX

1.3.1: Identify the users of the information systems

NSM ICT-SP

1.3.2: Classification of information assets

TISAX

1.3.2: Identify and define the different user categories

NSM ICT-SP

1.3.3: Identify roles and responsibilities linked especially to ICT security

NSM ICT-SP

1.3.3: Use of approved external IT services

TISAX

1.3.4: Use of approved software

TISAX

1.3: Manage IT and OT Asset Configuration

C2M2

1.3: Utilize an Active Discovery Tool

CIS 18

1.4 (MIL2): Manage Changes to IT and OT Assets

C2M2

1.4 (MIL3): Manage Changes to IT and OT Assets

C2M2

1.4.1: Management of Information Security Risks

TISAX

1.4: Manage Changes to IT and OT Assets

C2M2

1.4: Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory

CIS 18

1.5 (MIL1): Management Activities for the ASSET domain

C2M2

1.5 (MIL2): Management Activities for the ASSET domain

C2M2

1.5 (MIL3): Management Activities for the ASSET domain

C2M2

1.5.1: Assessment of policies and requirements

TISAX

1.5.2: External review of ISMS

TISAX

1.5: Management Activities for the ASSET domain

C2M2

1.5: Use a Passive Asset Discovery Tool

CIS 18

1.6.1: Reporting of security events

TISAX

1.6.2: Management of reported events

TISAX

1.6.3: Crisis preparedness

TISAX

10 §: Johdon vastuu

Kyberturvallisuuslaki

10. Processing of personal data relating to criminal convictions and offences

GDPR

10.1 (MIL2): Establish Cybersecurity Program Strategy

C2M2

10.1 (MIL3): Establish Cybersecurity Program Strategy

C2M2

10.1.1: Policy on the use of cryptographic controls

ISO 27001

10.1.2: Key management

ISO 27001

10.1.2: Key management

ISO 27017

10.1: Cryptographic controls

ISO 27001

10.1: Cryptographic controls

ISO 27017

10.1: Deploy and Maintain Anti-Malware Software

CIS 18

10.1: Establish Cybersecurity Program Strategy

C2M2

10.1: Non-conformity and corrective action

ISO 27001

10.2 (MIL2): Establish and Maintain Cybersecurity Program

C2M2

10.2 (MIL3): Establish and Maintain Cybersecurity Program

C2M2

10.2: Establish and Maintain Cybersecurity Program

C2M2

10.2: Configure Automatic Anti-Malware Signature Updates

CIS 18

10.2: Continuous improvement

ISO 27001

10.3 (MIL1): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL2): Management Activities for the PROGRAM domain

C2M2

10.3 (MIL3): Management Activities for the PROGRAM domain

C2M2

10.3: Disable Autorun and Autoplay for Removable Media

CIS 18

10.3: Management Activities for the PROGRAM domain

C2M2

10.4: Configure Automatic Anti-Malware Scanning of Removable Media

CIS 18

10.5: Enable Anti-Exploitation Features

CIS 18

10.6: Centrally Manage Anti-Malware Software

CIS 18

10.7: Use Behavior-Based Anti-Malware Software

CIS 18

10: Cryptography

ISO 27001

10: Cryptography

ISO 27017

10: Cybersecurity Program Management (PROGRAM)

C2M2

10: Prosessi väärinkäytöksiin reagoimiseksi

Digiturvan kokonaiskuvapalvelu

11 §: Poikkeamailmoitukset viranomaiselle

Kyberturvallisuuslaki

11. Processing which does not require identification

GDPR

11.1.1: Physical security perimeter

ISO 27001

11.1.2: Physical entry controls

ISO 27001

11.1.3: Securing offices, rooms and facilities

ISO 27001

11.1.4: Protecting against external and environmental threats

ISO 27001

11.1.5: Working in secure areas

ISO 27001

11.1.6: Delivery and loading areas

ISO 27001

11.1: Establish and Maintain a Data Recovery Process

CIS 18

11.1: Secure areas

ISO 27001

11.2.1: Equipment siting and protection

ISO 27001

11.2.2: Supporting utilities

ISO 27001

11.2.3: Cabling security

ISO 27001

11.2.4: Equipment maintenance

ISO 27001

11.2.5: Removal of assets

ISO 27001

11.2.6: Security of equipment and assets off-premises

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27001

11.2.7: Secure disposal or re-use of equipment

ISO 27017

11.2.8: Unattended user equipment

ISO 27001

11.2.9: Clear desk and clear screen policy

ISO 27001

11.2: Equipment

ISO 27001

Requirement description

How to fill the requirement

Zakon o kibernetičkoj sigurnosti (Croatia)

Članak 34: Provedba revizije kibernetičke sigurnosti

Examples of other requirements this task affects

Tasks included in the policy

Universal cyber compliance language model: Comply with confidence and least effort

Subscribe to Academy today

Webinars

Videos

Helps

Blogs

Resources

Content library