Content library
CyberFundamentals (Belgium)
PR.IP-7: Protection processes are improved.

How to fill the requirement

CyberFundamentals (Belgium)

PR.IP-7: Protection processes are improved.

Task name
Priority
Status
Theme
Policy
Other requirements
Continuous improvement and documentation
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Cyber security management
requirements

Task is fulfilling also these other security requirements

PR.IP-7: Protection processes
NIST
10.1: Continuous improvement
ISO27k1 Full
CC4.2: Evaluation and communication of internal control deficiencies
SOC 2
21.4: Non-conformities and corrective actions
NIS2
1.5.2: External review of ISMS
TISAX
1. Task description

The organization shall continuously strive to improve the performance of the information security management system. Ways to improve are being actively sought - not just through audits or clear non-conformities.

Task owner is responsible for documenting the improvements made to the management system and dividing them into tasks to be performed, monitoring task execution and assessing the reached effects.

Regular periodic analysis and learning of incidents
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Incident management
Incident management and response
requirements

Task is fulfilling also these other security requirements

16.1.6: Learning from information security incidents
ISO27 Full
PR.IP-7: Protection processes
NIST
PR.IP-8: Protection effectiveness
NIST
DE.DP-5: Detection processes improvment
NIST
RS.AN-2: The impact of the incident
NIST
1. Task description

The knowledge gained from analyzing and resolving security incidents should be used to reduce the likelihood of future incidents and their impact.

The organization regularly analyzes incidents as a whole. This process examines the type, amount and cost of incidents with the aim of identifying recurrent and significant incidents that need more action.

If recurrent incidents requiring response are identified, based on them:

  • new management tasks are created or current ones expanded
  • security guidelines in this area are refined or extended
  • a case example of the incident is created that is used to train staff to respond to or avoid similar incidents
No items found.