Markdown Editor
에디터 열기

EU 디지털 회복력(DORA·NIS2) 키트

DORA와 NIS2 대응: ICT 위험 프레임워크, 제3자 등록부, 중대 사고 보고, CRA 제품 의무, 위협 기반 테스트.

사용 순서에 따라 5단계로 정리한 템플릿 11개입니다. 편집기에서 템플릿을 열어 작성한 뒤 PDF, DOCX 또는 HTML로 내보낼 수 있습니다.

1단계

문제 정의

  1. NIS2 Cybersecurity Risk-Management Measures Template (Article 21)

    전체

    NIS2 classification, jurisdiction, management duties, measures (a) to (j) mapped to CIR 2024/2690, incident reporting, supply chain, metrics, transposition

    Directive (EU) 2022/2555 (NIS2) Art. 20, 21, 23; Implementing Regulation (EU) 2024/2690; ENISA guidance v1.0 (June 2025)

  2. DORA ICT Risk Management Framework Template

    전체

    DORA ICT risk management framework: Article 5 governance, Article 6(8) strategy, risk tolerance, RTS 2024/1774 policy map, review report, traceability

    DORA (EU) 2022/2554 Arts 5-16; Delegated Reg (EU) 2024/1774
2단계

소싱

  1. DORA Register of Information Template (ICT Third-Party Arrangements)

    전체

    DORA Art. 28(3) register: templates B_01.01 to B_99.01, arrangements, providers and LEI/EUID, supply chain ranks, functions, assessments, concentration, exit

    Regulation (EU) 2022/2554 (DORA) Art. 28 to 30; Implementing Regulation (EU) 2024/2956

  2. Supplier Security Assessment Template

    표준

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I
3단계

장애

  1. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    전체

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  2. DORA Major Incident Report Template (Classification, Art. 19)

    전체

    DORA major ICT incident: classification thresholds, reporting clock, initial, intermediate and final report fields (ITS Annex I), client notice, cyber threats

    DORA Art. 19; Delegated Reg. (EU) 2024/1772, 2025/301; Implementing Reg. (EU) 2025/302

  3. Security Incident Report Template (NIST SP 800-61 Rev. 3)

    전체

    Incident record and report: awareness, timeline, impact, evidence custody, ATT&CK analysis, actions, GDPR/NIS2/CRA/DORA/SEC clocks, CSF 2.0 lessons

    NIST SP 800-61 Rev. 3 (2025); NIST CSF 2.0; GDPR Art. 33; NIS2 Art. 23; CRA Art. 14; DORA Art. 19
4단계

제품

  1. CRA Technical Documentation and EU Declaration of Conformity Template

    전체

    EU CRA Annex VII file: product, design, Art. 13 risk assessment, Annex I checklist, support period, standards, tests, SBOM, Art. 32 module, Annex V DoC

    Regulation (EU) 2024/2847 (Cyber Resilience Act) Annex I, V, VII; Art. 13, 32

  2. CRA Vulnerability Handling and Reporting Procedure Template

    전체

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP
5단계

리허설과 테스트

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    전체

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84

  2. Red Team Engagement Plan Template (TIBER-EU, DORA TLPT)

    전체

    Threat-led red team plan: CIF scope and flags, control team, scenarios, rules of engagement, risks, timeline, replay and purple teaming, remediation

    TIBER-EU (Jan 2025); DORA Art. 26 and 27; Delegated Regulation (EU) 2025/1190