Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If we are a NIS2 or DORA entity, what changes in how policies are governed?

3 decision pointsThe pack behind this answer: Security Policy Management

Add to board memo

The short answer

Recommendation
Keep your policy lifecycle and change four things: the management body itself approves the top policy and the framework standard, every tier is reviewed at least yearly and after any major ICT-related incident, the set covers the regulated topics, and a DORA financial entity checks each ICT security policy against Delegated Regulation (EU) 2024/1774 Article 2(2).
Reasoning
The pack cites NIS2 Article 20(1), under which the management body approves the cybersecurity risk-management measures, and DORA, under which it is responsible for the ICT risk management framework. That is why a delegate is not enough at the top. DORA Article 6(5), as the pack cites it, requires that framework to be reviewed at least once a year and after major ICT-related incidents, so procedures and guidelines lose their longer interval. The regimes also name topics a policy set must cover, such as risk analysis, information system security and assessing the effectiveness of the measures. Tiers, owners, consultation, publication and acknowledgement stay the same.
Considerations
  • The article references are those the CISO Times policy pack cites. Check the regulation's own text when you write each topic policy.
  • The management body is the board where there is one; the management board in a two-tier structure; executive management where there is no board. Look for its own minute, not an executive committee acting for it.
  • If you are not sure whether the DORA content rules apply to you, treat them as applying.
  • Keep the independent reviewer separate from information security and executive management: internal audit reporting to the board or its equivalent body, or an external reviewer once a year.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartYou are a NIS2 or DORA entityStepThe management body approves the top policy and frameworkDecisionIs the top policy's approval in a management body minute?StepTake both documents to the management body's next meetingStepSet every tier's review interval to 12 monthsStepTreat any major ICT-related incident as a review triggerStepCheck the policy set covers the regulated topicsDecisionAre you a DORA financial entity?StepCheck each ICT security policy against Article 2(2)StepKeep each quarter-end copy of the registerDecisionIs the independent reviewer separate from security and executives?StepMove the check to internal audit or an external reviewerOutcomePolicies governed to the regulated profile

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 13 steps.

  1. Start

    You are a NIS2 or DORA entity

    The mechanics stay the same: tiers, owners, consultation, publication and acknowledgement. What changes is who approves at the top, how often documents are reviewed, what the set covers and, for DORA financial entities, what each ICT security policy contains. Record that your policy lifecycle procedure is part of your ICT risk management framework.

    In the pack

  2. Step

    The management body approves the top policy and framework

    Under NIS2 Article 20(1) the management body approves the cybersecurity risk-management measures, and under DORA it is responsible for the ICT risk management framework. Name the management body itself, not a delegate, as approver of the top information security policy and of the policy framework standard, and record its approval in its minutes.

    In the pack

    See also

  3. Decision

    Is the top policy's approval in a management body minute?

    Look for the minute, not an executive committee acting for it. The management body is the board where there is one; in a two-tier structure, the management board; where there is no board, executive management. For a DORA financial entity, each ICT security policy shows the date of its formal approval by the management body.

    In the pack

  4. Step

    Take both documents to the management body's next meeting

    Send the top policy and the policy framework standard with an approval pack: the final text, a summary of changes, the material-change classification and the comment log. The minute gives the approval date each document shows.

    In the pack

  5. Step

    Set every tier's review interval to 12 months

    DORA Article 6(5) requires the ICT risk management framework to be reviewed at least once a year and after major ICT-related incidents. Set every tier to 12 months, including procedures and guidelines, which the pack otherwise reviews every 24 months. Each next review date is the approval date plus 12 months, or earlier.

    In the pack

    See also

  6. Step

    Treat any major ICT-related incident as a review trigger

    The pack's review triggers already include a major incident. A regulated entity treats a major ICT-related incident as a trigger in every case, and reviews the documents it touches whatever their next review date. Information security tells each owner within 5 working days of learning of a trigger.

    In the pack

  7. Step

    Check the policy set covers the regulated topics

    NIS2 Article 21(2)(a) calls for policies on risk analysis and information system security, and 21(2)(f) for policies and procedures to assess the effectiveness of the measures. DORA Article 9(4)(a) calls for a documented information security policy. The regulated profile of a policy coverage assessment adds the topics that follow from these.

    In the pack

    See also

  8. Decision

    Are you a DORA financial entity?

    The content rules in Delegated Regulation (EU) 2024/1774 apply to DORA financial entities. An entity under NIS2 alone can skip the next step. If you are not sure, treat them as applying.

    In the pack

  9. Step

    Check each ICT security policy against Article 2(2)

    Article 2(2) asks that ICT security policies show the date of formal approval by the management body, contain indicators and record exceptions, specify staff responsibilities and the consequences of non-compliance, list the documentation kept, set roles for maintaining them, and are reviewed and updated for material changes. Keep the mapping as an appendix, and check the remaining points against the Regulation's text.

    In the pack

  10. Step

    Keep each quarter-end copy of the register

    Freeze the register at each quarter end and keep that copy as a record for supervisors. Keep the management body's minutes with the approval records. Regulated financial entities typically keep ICT risk records for at least five years; confirm your own obligations.

    In the pack

  11. Decision

    Is the independent reviewer separate from security and executives?

    Someone checks at least once a year that documents in force are approved, current, published and acknowledged. In a regulated entity keep that reviewer separate from information security and from executive management. For a DORA financial entity, the approved responsibility matrix is also the record of roles for developing, implementing and maintaining policies.

    In the pack

  12. Step

    Move the check to internal audit or an external reviewer

    A reviewer who keeps the register, or who gave the approvals, would be checking their own work. Use internal audit reporting to the board or its equivalent body, or an external reviewer once a year.

    In the pack

  13. Outcome

    Policies governed to the regulated profile

    The management body approves the top policy, every tier is reviewed at least yearly and after major incidents, the set covers the regulated topics, and the records are kept for supervisors. Document currency and acknowledgement coverage are still reported to management every quarter.

    In the pack

Practical checklist

  1. Record that your policy lifecycle procedure is part of your ICT risk management framework.
  2. Check the top policy and the policy framework standard each carry a management body minute approving them. If not, take both to its next meeting with an approval pack.
  3. Set every tier's review interval to 12 months, procedures and guidelines included.
  4. Treat any major ICT-related incident as a review trigger for the documents it touches.
  5. Check the policy set covers the regulated topics.
  6. For a DORA financial entity, check each ICT security policy against Article 2(2), and keep the mapping as an appendix.
  7. Freeze a copy of the register at each quarter end and keep it as a record for supervisors.
  8. Have an independent reviewer check, at least once a year, that documents in force are approved, current, published and acknowledged.

Evidence to have ready

  • The management body's minutes approving the top policy and the policy framework standard, and the approval date each document shows.
  • The register, with every tier on a 12-month review interval, and its quarter-end copies.
  • Review records for documents reviewed after a major ICT-related incident.
  • For a DORA financial entity, the Article 2(2) mapping appendix and the approved responsibility matrix as the record of roles for maintaining policies.
  • The record of the independent reviewer's annual check.

Assumptions

  • You already know that NIS2 or DORA applies to you.
  • The article references are those the CISO Times policy governance pack cites. Check the regulation's own text when you write each topic policy.

Not covered here