Risk analysis and security policy

Every organisation in scope of the Cybersecurity Act starts with two basics: an approved security policy and a way to assess risk. Without those two, nobody knows where the organisation is heading or which risks it knowingly accepts.

What this means in practice

Your board approves a security policy with a date and version number, assigns roles and authorities so no task is left unowned, and sets up a working security cycle in which the policy is reviewed periodically. You also record a risk management policy: which method you use, when a risk is acceptable, and which security requirements follow from it.

Why this is in the law

Without an approved policy and a risk method, a supervisor has no starting point to judge your other measures — the other nine measure families build on this one.