Requirement
The cybersecurity requirements for managing information and technology assets must be reviewed periodically.
Control Implementation Guidelines
- Review and update cybersecurity requirements for information and technology assets management in the organization periodically according to a documented and approved plan for review and based on a planned interval or in the event of changes in relevant laws and regulations
- Document and approve review and changes to the organization's cybersecurity requirements of the information and technology assets management by the head of the organization or his/her deputy
Expected Deliverables
- Results of information and technology assets management cybersecurity requirements implementation review in the organization
- A document that defines the cybersecurity requirements implementation review cycle to manage the information and technology assets of the organization (Compliance Assessment Schedule)
- Log of updates and changes to the information and technology asset management cybersecurity requirements
- Compliance assessment report that outlines the results of the cybersecurity requirements implementation assessment for information and technology asset management
- An approved document that sets the policy's review schedule
- Policy indicating that it has been reviewed and updated, and that changes have been documented and approved by the head of the organization or his/her deputy
- Formal approval by the head of the organization or his/her deputy on the updated policy (e.g., via the organization's official e-mail, paper or electronic signature)
