Readiness Check

Is your information security policy formally approved by the management body, with the approval date recorded in the document itself?

CIR Annex 1.1

Does at least one named person report directly to the management body on network and information system security?

CIR Annex 1.2

Have you documented a risk assessment and a risk treatment plan, with residual risk formally accepted by the management body?

CIR Annex 2.1

Do you review compliance with your own policies at planned intervals and report the result upward?

CIR Annex 2.2 No exemption

Has an independent reviewer — someone outside the line authority of what they review — assessed your security approach?

CIR Annex 2.3 No exemption

Does your incident handling policy assign roles and cover detection, analysis, containment, recovery, documentation and reporting?

CIR Annex 3.1

Do you keep a risk-based list of assets subject to logging, with logs protected, backed up and alarm thresholds defined?

CIR Annex 3.2

Is there a simple route for employees, suppliers and customers to report suspicious events?

CIR Annex 3.3

Do you assess events against predefined criteria and re-examine recurring incidents quarterly?

CIR Annex 3.4 No exemption

Are containment, eradication and recovery documented as procedures — and tested at planned intervals?

CIR Annex 3.5

Do post-incident reviews identify root cause and feed changes back into your risk treatment?

CIR Annex 3.6

Is your business continuity and disaster recovery plan grounded in a documented business impact analysis?

CIR Annex 4.1

Are backups held off the production network at sufficient distance, integrity-checked, and restore-tested?

CIR Annex 4.2

Does your crisis process name the communication route to your CSIRT and competent authority?

CIR Annex 4.3

Are power, cooling and telecommunications protected, monitored, and tested against failure?

CIR Annex 13.1

Do supplier contracts carry incident-notification duties, audit rights, and security requirements that flow through to subcontractors?

CIR Annex 5.1

Do you maintain a current registry of direct suppliers with a contact point and the products or services each provides?

CIR Annex 5.2 No exemption

Does procurement set security requirements and require update support for the product’s whole lifetime, or replacement after end of support?

CIR Annex 6.1

Are secure development rules written down and applied to outsourced development as well as in-house work?

CIR Annex 6.2 No exemption

Are secure configurations defined, enforced by tooling, and monitored for drift?

CIR Annex 6.3

Are changes tested and impact-assessed before implementation, with emergency deviations documented afterwards?

CIR Annex 6.4

Is security testing scoped by risk assessment, with criticality and mitigating actions recorded?

CIR Annex 6.5

Are patches applied within a reasonable time — and is every decision not to patch documented and substantiated?

CIR Annex 6.6 No exemption

Is your network architecture documented and current, with remote and service-provider access explicitly controlled and time-bound?

CIR Annex 6.7

Are production, development and administration networks separated, with critical systems in secured zones?

CIR Annex 6.8

Do you detect or prevent malicious and unauthorised software across your systems?

CIR Annex 6.9

Do you monitor vulnerability sources and publish a disclosure route aligned to your national coordinated vulnerability disclosure policy?

CIR Annex 6.10

Have you set control thresholds for physical and environmental threats, and do you alert when they are breached?

CIR Annex 13.2

Have you defined what gets measured, by which method, when, and who analyses the result — and do you review that policy?

CIR Section 7 · Art 21(2)(f)

Does your awareness programme repeat over time, cover new starters, and reach suppliers as well as staff?

CIR Annex 8.1

Have you identified which roles need security-specific training — and assessed whether the training worked?

CIR Annex 8.2 No exemption

Does your cryptography policy set algorithm type and strength by asset classification, and cover the full key lifecycle from generation to destruction?

CIR Section 9 · Art 21(2)(h)

Do employees, suppliers and the management body have documented, accepted security responsibilities?

CIR Annex 10.1 No exemption

Are background checks defined by role and completed before the person starts in that role?

CIR Annex 10.2

Do contracts define which security duties survive termination or a change of role?

CIR Annex 10.3 No exemption

Is there a communicated disciplinary process for security policy violations?

CIR Annex 10.4

Do your access control policies cover physical access and system-to-system access, not user logins alone?

CIR Annex 11.1

Are access rights granted on least privilege, revoked on role change, logged, and reviewed at planned intervals?

CIR Annex 11.2 No exemption

Do administrators hold separate administration accounts, individualised and restricted as far as possible?

CIR Annex 11.3 No exemption

Are administration systems used only for administration, separated from other software, and protected by authentication and encryption?

CIR Annex 11.4 No exemption

Is every identity unique and tied to one person, with shared identities explicitly approved and documented?

CIR Annex 11.5 No exemption

Do you force credential resets after repeated failed attempts, terminate inactive sessions, and require separate credentials for privileged accounts?

CIR Annex 11.6

Do all in-scope assets carry a classification level tied to confidentiality, integrity, authenticity and availability?

CIR Annex 12.1

Does an asset-handling policy cover the whole lifecycle, through to irretrievable deletion or destruction?

CIR Annex 12.2

Is removable media blocked by default and permitted only where an organisational reason exists?

CIR Annex 12.3

Is your asset inventory complete, accurate, current — and are changes recorded traceably?

CIR Annex 12.4 No exemption

Are assets in personnel custody deposited, returned or deleted on termination, and is that documented?

CIR Annex 12.5 No exemption

Are security perimeters set by risk assessment, with premises continuously monitored for unauthorised physical access?

CIR Annex 13.3

Is multi-factor or continuous authentication applied where your asset classification calls for it?

CIR Annex 11.7

Are voice, video and text communications secured — and is there a secured emergency communication system inside the entity for use when normal channels are down?

Art 21(2)(j) only