Governance

• The ICT risk management framework is approved by the management body.
• A person responsible for managing ICT-related risk has been appointed.
• A formal information security policy exists.
• Regular ICT risk reporting to management is in place.
• The management body is trained on digital resilience issues.
• A dedicated budget for digital operational resilience is allocated.

← Previous phase: Analyse