Markdown Editor
Mở trình soạn thảo

Bộ mẫu khả năng chống chịu số EU (DORA và NIS2)

Đáp ứng DORA và NIS2: khung rủi ro ICT, sổ đăng ký bên thứ ba, báo cáo sự cố lớn, nghĩa vụ sản phẩm CRA và kiểm thử theo mối đe dọa.

11 mẫu trong 5 bước, theo thứ tự sử dụng. Mở mẫu bất kỳ trong trình soạn thảo, điền nội dung rồi xuất ra PDF, DOCX hoặc HTML.

Bước 1

Định hình bài toán

  1. NIS2 Cybersecurity Risk-Management Measures Template (Article 21)

    Đầy đủ

    NIS2 classification, jurisdiction, management duties, measures (a) to (j) mapped to CIR 2024/2690, incident reporting, supply chain, metrics, transposition

    Directive (EU) 2022/2555 (NIS2) Art. 20, 21, 23; Implementing Regulation (EU) 2024/2690; ENISA guidance v1.0 (June 2025)

  2. DORA ICT Risk Management Framework Template

    Đầy đủ

    DORA ICT risk management framework: Article 5 governance, Article 6(8) strategy, risk tolerance, RTS 2024/1774 policy map, review report, traceability

    DORA (EU) 2022/2554 Arts 5-16; Delegated Reg (EU) 2024/1774
Bước 2

Mua sắm và nhà cung cấp

  1. DORA Register of Information Template (ICT Third-Party Arrangements)

    Đầy đủ

    DORA Art. 28(3) register: templates B_01.01 to B_99.01, arrangements, providers and LEI/EUID, supply chain ranks, functions, assessments, concentration, exit

    Regulation (EU) 2022/2554 (DORA) Art. 28 to 30; Implementing Regulation (EU) 2024/2956

  2. Supplier Security Assessment Template

    Chuẩn

    Supplier tiering with review intervals, security posture checklist, secure development and SBOM questions, concentration and exit risk, NIS2, DORA, CRA, GDPR hooks, decision

    ISO/IEC 27001:2022 A.5.19 to A.5.23; NIS2 Art. 21; DORA Art. 28 to 30; CRA Annex I
Bước 3

Sự cố

  1. Incident Response Plan Template (NIST SP 800-61 Rev. 3)

    Đầy đủ

    IR policy, CSF 2.0 mapping, roles, classification, containment, evidence and chain of custody, TLP 2.0, GDPR/NIS2/DORA/CRA notification clocks, metrics

    NIST SP 800-61 Rev. 3; NIST CSF 2.0; ISO/IEC 27001:2022 A.5.24 to A.5.28; GDPR, NIS2, DORA, CRA Art. 14

  2. DORA Major Incident Report Template (Classification, Art. 19)

    Đầy đủ

    DORA major ICT incident: classification thresholds, reporting clock, initial, intermediate and final report fields (ITS Annex I), client notice, cyber threats

    DORA Art. 19; Delegated Reg. (EU) 2024/1772, 2025/301; Implementing Reg. (EU) 2025/302

  3. Security Incident Report Template (NIST SP 800-61 Rev. 3)

    Đầy đủ

    Incident record and report: awareness, timeline, impact, evidence custody, ATT&CK analysis, actions, GDPR/NIS2/CRA/DORA/SEC clocks, CSF 2.0 lessons

    NIST SP 800-61 Rev. 3 (2025); NIST CSF 2.0; GDPR Art. 33; NIS2 Art. 23; CRA Art. 14; DORA Art. 19
Bước 4

Sản phẩm

  1. CRA Technical Documentation and EU Declaration of Conformity Template

    Đầy đủ

    EU CRA Annex VII file: product, design, Art. 13 risk assessment, Annex I checklist, support period, standards, tests, SBOM, Art. 32 module, Annex V DoC

    Regulation (EU) 2024/2847 (Cyber Resilience Act) Annex I, V, VII; Art. 13, 32

  2. CRA Vulnerability Handling and Reporting Procedure Template

    Đầy đủ

    EU CRA procedure: scope, RACI, Annex I Part II, SBOM, CVD, EPSS/SSVC prioritisation, Article 14 24h/72h/final reports via ENISA SRP, user notices, timeline

    Regulation (EU) 2024/2847 (CRA) Art. 13-16, Annex I Part II; ENISA SRP
Bước 5

Diễn tập và kiểm thử

  1. Tabletop Exercise Template (CISA CTEP, HSEEP, NIST SP 800-84)

    Đầy đủ

    Discussion-based exercise pack: objectives and criteria, roles, ground rules, ransomware scenario with injects, questions, facilitator notes, AAR and Improvement Plan

    CISA Tabletop Exercise Packages; FEMA HSEEP 2020; NIST SP 800-84

  2. Red Team Engagement Plan Template (TIBER-EU, DORA TLPT)

    Đầy đủ

    Threat-led red team plan: CIF scope and flags, control team, scenarios, rules of engagement, risks, timeline, replay and purple teaming, remediation

    TIBER-EU (Jan 2025); DORA Art. 26 and 27; Delegated Regulation (EU) 2025/1190